FormBook RTF malware analysis — malicious · cf193637626e85b3

MALICIOUS

RTF

6.6 KB First seen: 2019-04-17

MD5: cccbc09dd66645e8d9160a769bc6eec7 SHA-1: cba9616704d73c779e8922d32da2351cda589403 SHA-256: cf193637626e85b34a7ccaed9e4459b75605af46cedc95325583b879990e0e61

180 Risk Score

Malware Insights

FormBook · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document containing OLE object data and an embedded Equation Editor object, triggering critical heuristics for exploitation. The ClamAV signature explicitly identifies it as Rtf.Dropper.FormBook, indicating its function as a dropper for the FormBook information-stealer. The embedded OLE object is likely responsible for triggering the exploit and downloading the secondary payload.

Heuristics 4

Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
ClamAV: Rtf.Dropper.FormBook-6749868-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.FormBook-6749868-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000b29.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xB29	1974 bytes
SHA-256: `feb6643e5e8d3d5db28db0c84c929a7f8c50a1a689fc680aed2d5a9885b5ff55`

Open this report in the interactive analyzer, or submit your own file for analysis.