Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 d6c3faa20ae3e921…

MALICIOUS

RTF / .DOC

9.3 KB First seen: 2022-03-07
MD5: c9ce9ac67d06449eef30201023cc23d0 SHA-1: 5406ef41deef05a43a765db36334bfd011058b76 SHA-256: d6c3faa20ae3e9212f387e9484a50e5e90177425fcd469c5b33fab6edc315c1a
121 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is an RTF document that leverages the Equation Editor vulnerability (CVE-2017-11882). Heuristics indicate the presence of OLE object data and an ".objupdate" directive, which forces the activation of the embedded OLE object. This strongly suggests the document is designed to exploit this vulnerability to execute code, likely for downloading and running a second-stage payload. No specific family could be identified.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000011af.bin
c838ec1703a0ab981ac04b0911a132efbd96365b5b9fc972b2a1d448f6914adc
rtf-objdata-decoded RTF \objdata at offset 0x11AF 2280 bytes