RTF malware analysis — malicious · b98efd783f962c8c

MALICIOUS

RTF

572.6 KB First seen: 2019-04-18

MD5: 25b3480ddaf8db61e11318746fd4dd49 SHA-1: 57436fbfe04a10708f604a0882706ac3b4f8fa60 SHA-256: b98efd783f962c8c5a2f12570b1a2be2583e168861c44f1fc6694828912623a4

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The file is an RTF document containing OLE object data, which is a known vector for exploiting the Equation Editor vulnerability (CVE-2017-11882). The critical ClamAV detection confirms this specific exploit. The embedded OLE object is designed to trigger code execution upon activation, likely leading to the download and execution of a secondary payload.

Heuristics 3

ClamAV: Doc.Exploit.CVE_2017_11882-6934206-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Exploit.CVE_2017_11882-6934206-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000004ae.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4AE	4658 bytes
SHA-256: `50155351febd07ab219f2e5ec92b67df7865c843b2c9e2efec1fe787ffa2638e`

Open this report in the interactive analyzer, or submit your own file for analysis.