Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 a38eadb2b582a860…

MALICIOUS

RTF / .DOC

321.7 KB
MD5: 6dca6173289d54dc86ca9649e452d6f3 SHA-1: c5818a6dfb820b8a9290241eb29aa3ecca414396 SHA-256: a38eadb2b582a8603035c3c79f98d11b10060ad02583da8637e113f01fece6d4
202 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059 Command and Scripting Interpreter

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability (CVE-2017-11882). This is a critical finding that strongly suggests the document is designed to exploit this known flaw. The heuristic firings confirm the presence of OLE object data and the specific Equation Editor CLSID, along with an objupdate call that forces OLE activation. The ClamAV detection explicitly names the CVE, reinforcing the attack vector. The document body is heavily obfuscated and does not provide direct clues to the payload's intent, but the exploit itself is the primary attack pattern.

Heuristics 6

  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Exploit.CVE_2017_11882-6584355-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_11882-6584355-1
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001beb.bin
b3ac40766402080c4a48d09ab8d8970df92e6d393ea664fd643f2fdb12e7b9a2		 rtf-objdata-decoded RTF \objdata at offset 0x1BEB 160869 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.98, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.