Malicious RTF — malware analysis report

Static analysis result for SHA-256 be90083aacdd2a3b…

MALICIOUS

RTF

211.4 KB First seen: 2020-07-24
MD5: 9c78815dce144b8ee97f952d3e8c106b SHA-1: 2c4b4d224c4577a5c513baaa9318b5b2d962b483 SHA-256: be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document that contains an embedded OLE object, specifically targeting the Equation Editor vulnerability. The presence of `RTF_EQUATION_EDITOR` and `RTF_OBJUPDATE` heuristics indicates that the document is designed to exploit this vulnerability, likely leading to the execution of a second-stage payload. The `RTF_OBJDATA` heuristic further confirms the presence of embedded OLE object data, which is characteristic of this exploit.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001189.bin rtf-objdata-decoded RTF \objdata at offset 0x1189 64342 bytes
SHA-256: b0ea469c6b93acb742e34474db8011f1ab31a7aad8e2e76707623b244db61afe

Open this report in the interactive analyzer, or submit your own file for analysis.