Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 b5f05dc11b11551d…

MALICIOUS

RTF / .DOC

27.9 KB First seen: 2023-04-11
MD5: 9c47d0030fe7da4d2ad4fcc32b6d1d65 SHA-1: f6d5657d7fa0463f582ab639223ce4a515296c50 SHA-256: b5f05dc11b11551df7ae871ffe186c7f483570d40dc641445b06f3c1d0b2b55a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 User Execution: Malicious Link T1059.005 PowerShell

The RTF document contains OLE object data and specifically triggers the Equation Editor exploit. The presence of a lure instructing the user to 'Enable editing' further supports the malicious intent. The primary goal appears to be exploiting the Equation Editor vulnerability to execute a secondary payload, likely delivered via the embedded OLE object.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00004c1b.bin
e792291b03265bfbe462fd9923697e4e2986ae256dfb12eebc25bda41da0c4ce
rtf-objdata-decoded RTF \objdata at offset 0x4C1B 1298 bytes