RTF malware analysis — malicious · b9729d1f374886ce

MALICIOUS

RTF

63.4 KB First seen: 2022-10-13

MD5: 0d5594ec089e4ebcec0bfe3b3c60eca0 SHA-1: 407a25192cb5fa5bb61c2bfed0985a327b2e24e0 SHA-256: b9729d1f374886cef6f6c076e3e3cb736ba3ef80ecdc3606aa060e2954bbc065

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document that contains OLE object data and triggers the CVE-2017-11882 vulnerability in Microsoft Equation Editor. This exploit is known to be used for delivering malicious payloads. The presence of `RTF_OBJDATA` and `RTF_OBJUPDATE` heuristics further confirms the exploitation of embedded OLE objects. The attack pattern is consistent with exploiting this known vulnerability to execute arbitrary code, likely for downloading and running a second-stage payload.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001459.bin` `e09e0e248994d41167d61b690c87d9bac0ab1ac400af3e7c6e519b2fe9a50244`	rtf-objdata-decoded	RTF \objdata at offset 0x1459	4148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.