Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 c15849c7b63c4e93…

MALICIOUS

RTF / .DOC

36.8 KB First seen: 2023-04-19
MD5: 808aaf708b78f40674cc4194ee7b3212 SHA-1: bc53fe1dd3c7673541899365d227843cff218fca SHA-256: c15849c7b63c4e93226e2b971daf6c2f6b36a9521f8d017af8cfb7eaed6c84b3
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059 Command and Scripting Interpreter T1559 Component Object Model Hijacking

The sample is an RTF document containing an embedded OLE object with a specific Equation Editor ProgID, triggering critical heuristics for Equation Editor exploits. The \objupdate directive indicates an attempt to force OLE object activation, a common method for exploiting vulnerabilities like CVE-2017-11882. The document also contains a lure instructing the user to enable editing, suggesting it's a dropper designed to exploit this vulnerability to execute a malicious payload.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000440c.bin
a6ec1af564b29f4db551d09eaf917375d72f44e89068047af5f15c633001e3dc
rtf-objdata-decoded RTF \objdata at offset 0x440C 1688 bytes