RTF malware analysis — malicious · d077994117689645

MALICIOUS

RTF

1.47 MB First seen: 2020-09-15

MD5: d61663c38f8dd74e947127478d51a687 SHA-1: df4ce0f8833b1b19f3bd179803bf6ebe2ac36872 SHA-256: d0779941176896458f37442d49059d43fe4cfb270cb217ee21133881bb108b49

300 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object that exploits CVE-2017-11882 through the Equation Editor. This exploit is designed to execute arbitrary code, likely a second-stage payload. The extracted script content indicates an attempt to execute 'C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay' which is a common technique for malware to run malicious code disguised as a legitimate process.

Heuristics 7

Obfuscated Equation Editor ProgID + activation critical CVE related RTF_EQUATION_EDITOR

RTF decodes to an Equation.3 ProgID from top-level \objdata hex after nested RTF junk groups are ignored, and the document also contains \objemb plus \objupdate activation. This is an obfuscated Equation Editor exploit surface associated with CVE-2017-11882 / CVE-2018-0802 families, but no exact malformed MTEF CVE primitive was recovered from this object.
CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
ClamAV: Rtf.Dropper.Agent-8726735-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Dropper.Agent-8726735-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000cdc.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xCDC	7921 bytes
SHA-256: `a0395c756dc051fe31a1927812a2be9f52b986c77c5b7714d6ef54d32a9a7b82`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): WScript.CreateObject("WScript.Shell"), WScript.StdOut.WriteLine objExecObject.StdOut.ReadLine(
`objdata_01_off000055d9.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x55D9	126 bytes
SHA-256: `4ea58c2d73d124706d955652901881b68d3ae0e6e8c2f0e8a417936bade28c85`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).
`objdata_02_off000065ce.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x65CE	430959 bytes
SHA-256: `98dbdecc5bc81cf0dea8ba741f90bc8225877d3fab8ecdc07c77df6ca26d1312`

Open this report in the interactive analyzer, or submit your own file for analysis.