RTF malware analysis — malicious · af02d6aa479b24ed

MALICIOUS

RTF

32.0 KB First seen: 2019-06-27

MD5: 97f99c30cdebad57689e0f88a35df3ba SHA-1: f2068fd003e76fa520647bc02b09893972a412ab SHA-256: af02d6aa479b24edc480f4dc94dc181622641a72c0f96a32de13ee9fe8a7559b

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is an RTF document that contains OLE object data, specifically triggering an exploit for CVE-2017-11882. This vulnerability allows for arbitrary code execution when the embedded OLE object is activated. The ClamAV detection confirms this exploit is present and malicious. No document body or script content was available for further analysis.

Heuristics 4

ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000003b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3B	3622 bytes
SHA-256: `39ee101e2e7eee4d0fd1ee4ee858ff3517417badde9ea22d57ee4c4f2c1332c5`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL

Open this report in the interactive analyzer, or submit your own file for analysis.