RTF malware analysis — malicious · a5de6df9430d1b9e

MALICIOUS

RTF

113.0 KB Created: 2021-07-16 07:42:00

MD5: eadb63568de96f6f86bffc03b17ac4a2 SHA-1: c8c37b217c68e79045627f7a490cbc2dc6550eb8 SHA-256: a5de6df9430d1b9e900b43facc523353d98c46343fc8a7817f3d83297bc10d06

102 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This vulnerability allows for arbitrary code execution, indicating a likely exploit attempt. No document body or scripts were extracted, but the presence of this specific exploit is sufficient for a high confidence assessment.

Heuristics 4

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000032f7.bin` `5c183b51c94b175d023a6d6e636581b4e03cddb2b76039b4570a3bec852d4854`	rtf-objdata-decoded	RTF \objdata at offset 0x32F7	3629 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.