RTF / .DOC malware analysis — malicious · d250d500cf7203a1

MALICIOUS

RTF / .DOC

506.2 KB

MD5: dc8382a437175146d43b5fccc5f96e22 SHA-1: 5c7926c514c5bdd3b90dd7505b6943b1487a3b1a SHA-256: d250d500cf7203a1e5a0cd460746d7e6b95e41b1fa7dafe6dd8fab07626aa675

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

The RTF document contains embedded OLE objects, specifically triggering heuristics related to Equation Editor vulnerabilities. The presence of `RTF_EQUATION_EDITOR`, `RTF_OBJUPDATE`, and `RTF_OLE10NATIVE_STREAM` strongly suggests exploitation of a known Equation Editor flaw to achieve arbitrary code execution. No scripts were extracted, but the OLE object data itself is indicative of a malicious payload delivery mechanism.

Heuristics 6

Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM

RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001e6f.bin` `86aac56b811a1713dd033c1051515a645a06ede5956703c8880bae6e7c4c2567`	rtf-objdata-decoded	RTF \objdata at offset 0x1E6F	145981 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.97, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.