Malicious RTF — malware analysis report

Static analysis result for SHA-256 d5c03dac680c8c6f…

MALICIOUS

RTF

19.1 KB First seen: 2018-10-07
MD5: e6516009f4a92ff7bb458d3ab235497e SHA-1: 6e0a9d9d414e6ba6c03194c741e2e7ca458cf995 SHA-256: d5c03dac680c8c6f7639ea4b551783c7a23efbc372d8979c0319500c6562fc1a
160 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and specifically triggers heuristics related to Equation Editor vulnerabilities and OLE activation. This strongly suggests exploitation of a known vulnerability in the Equation Editor component to achieve arbitrary code execution. The embedded OLE object is likely a dropper for a secondary payload, although the specific payload could not be determined from the provided evidence.

Heuristics 4

  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001675.bin rtf-objdata-decoded RTF \objdata at offset 0x1675 4642 bytes
SHA-256: eba315bed3d27adf3ec0935d18ebad05bb46de9816dc55643d90e088c219c1af

Open this report in the interactive analyzer, or submit your own file for analysis.