Malicious RTF — malware analysis report

Static analysis result for SHA-256 afeb7677b573a79a…

MALICIOUS

RTF

11.5 KB
MD5: 8c953304a94209a33f4b63d71605d816 SHA-1: 17113e3d7f54e61d1acb6cca076f9d7d45f9ec8c SHA-256: afeb7677b573a79afb6fb48fa2d5211fabe514355b6aa010928e5cdebba5b9be
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 Malicious Link

The file is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics strongly indicates exploitation of CVE-2017-11882. This vulnerability is commonly used to download and execute a second-stage payload, leading to a full system compromise. The SHA256 hash is included as a primary IOC.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001b25.bin
94d38f0b2aeba277a7d36717c375901a44a0697281ca5bb8536f3318de2f3af3		 rtf-objdata-decoded RTF \objdata at offset 0x1B25 1470 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.