Malicious RTF — malware analysis report

Static analysis result for SHA-256 d8b1ef6d6cf1cce0…

MALICIOUS

RTF

70.3 KB
MD5: 1c7b27ffef2dba12d1a2d8db2de648dc SHA-1: d53728aea2d09999425f5386bdb6a00f4b959af4 SHA-256: d8b1ef6d6cf1cce0b2d5303986b88c4a36fac96f7b69d0d7e57fc82f2f31f8c8
160 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that leverages a known vulnerability in Microsoft Equation Editor (CVE-2017-11882). This vulnerability allows for arbitrary code execution when the object is processed. The critical heuristic firings directly indicate the presence of this exploit. No further stages or IOCs were extracted from this sample.

Heuristics 4

  • CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
    Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000010e.bin
084c397106f419d5bad831f0e2828892c616cf5c0404c4454525b87a5b8e6b5e		 rtf-objdata-decoded RTF \objdata at offset 0x10E 3631 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.