Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 ad18542579c305c2…

MALICIOUS

RTF / .DOC

2.62 MB
MD5: 8b68b971d4ab58d102fab177347191cd SHA-1: ba6381436dde5e3a431b069e63a620ff3552b4a9 SHA-256: ad18542579c305c222abeb44c7c1a08469acbe49e09a63f560275c8632c57602
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE objects and specifically triggers the Equation Editor vulnerability, indicating an attempt to exploit this component for code execution. The presence of ` tfobjupdate` further suggests that the embedded object is designed to be activated automatically. The extracted document body contains obfuscated JavaScript-like functions and hexadecimal strings, likely part of the exploit chain to download and execute a secondary payload.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000dea.bin
98a52a15413529c62634c8ee950faea4c0e2fcbd4083e1ff66f9ff7995cc2029
rtf-objdata-decoded RTF \objdata at offset 0xDEA 61363 bytes
objdata_01_off0003b882.bin
bd688238fe4a81b93b1791e1c8455780aa3bc451293f8827d97ccbf101b8d65e
rtf-objdata-decoded RTF \objdata at offset 0x3B882 555368 bytes