RTF malware analysis — malicious · c78350432da5e7f2

MALICIOUS

RTF

24.5 KB First seen: 2023-06-11

MD5: da4ee80c1cd71008a199b216b4f7dda3 SHA-1: af768a05faf58c990f32588177fad6d8c81a2021 SHA-256: c78350432da5e7f2f82243d367ae873020102a6c5aa1859fddf1e8ce7b418d21

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1204.002 Malicious File

The RTF file contains an embedded OLE object that leverages the Equation Editor vulnerability (CLSID found via RTF_EQUATION_EDITOR heuristic). The \objupdate directive indicates that the OLE object is designed to be activated automatically, triggering the exploit. This technique is commonly used to download and execute a second-stage payload, hence the high confidence in an exploitation for client execution attack pattern.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000019ab.bin` `f3eb671ea921fbfbdaeee50aa2435eedf71165ffd19d631e42454e92ab06d4c5`	rtf-objdata-decoded	RTF \objdata at offset 0x19AB	3671 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.