RTF malware analysis — malicious · d19b9cdf9f175fd8

MALICIOUS

RTF

11.4 KB First seen: 2023-03-13

MD5: 67d53c6ca1dda0546fc34f0667c1f3a3 SHA-1: 5b54209b40d8cc4dc2843051c3d4265f5678fa0a SHA-256: d19b9cdf9f175fd8833c9dbd62f5f01a0daa451b7e6b972a4d34b74c3bc409c7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Phishing: Spearphishing Attachment T1204.001 Malicious Link: Malicious Link T1129 Execution through API

The RTF file contains OLE object data and specifically triggers heuristics for Equation Editor exploitation and OLE object activation. This indicates the file is designed to exploit a vulnerability, likely CVE-2017-11882, to achieve code execution. The embedded OLE object data is the primary indicator of the exploit mechanism.

Heuristics 3

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000111f.bin` `74e9261c0053bcb141b85d5f11c2b0caecf45dc45ae451e611b34f9be2bcbeaf`	rtf-objdata-decoded	RTF \objdata at offset 0x111F	1547 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.