Malicious RTF — malware analysis report

Static analysis result for SHA-256 a843b0c799c7ad34…

MALICIOUS

RTF

21.8 KB
MD5: 7eeaa270fb5664c0ea9360c15bc51096 SHA-1: f880a806f28c2833431ded47908ab585b74fa74d SHA-256: a843b0c799c7ad34fa76f278db59da140d77af3a38295b0d74ea273013065ed4
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is an RTF document containing an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics strongly indicates exploitation of CVE-2017-11882. ClamAV detection confirms this as a malicious dropper. The embedded OLE object likely contains shellcode to download and execute a secondary payload.

Heuristics 4

  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Dropper.Agent-7701767-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7701767-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000ac.bin
9abce4615f3ad07f76d9d4371d1e63b221bba2d6b92444f8e09f10b0889fec1e		 rtf-objdata-decoded RTF \objdata at offset 0xAC 9151 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.