Malicious RTF — malware analysis report

Heuristics 6

• Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
  Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
• CVE-2018-0798 — Equation Editor Matrix record overflow critical CVE exact CVE_2018_0798
  RTF contains hex-encoded MTEF Matrix record exploit signature (NOP-sled 0x60 + padding 0x61 + return address 0x0BFB). CVE-2018-0798 exploits a stack buffer overflow in EQNEDT32.EXE's Matrix record parser and affected Equation Editor broadly, including builds patched for CVE-2017-11882. Widely used by APT groups (Conimes, KeyBoy, Emissary Panda, Rancor).
• ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
• \objupdate forces OLE activation high RTF_OBJUPDATE
  RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
• OLE object data medium RTF_OBJDATA
  RTF contains 2 \objdata section(s) — embedded OLE objects
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Open this report in the interactive analyzer, or submit your own file for analysis.