RTF malware analysis — malicious · da275dc8b7ac6639

MALICIOUS

RTF

24.4 KB First seen: 2023-06-01

MD5: c8319c8ef2883406bb46e668f1a30b60 SHA-1: b3d7c078ce0b666c556c4a44a73c801a283d6b01 SHA-256: da275dc8b7ac6639c91b1da9219ae2645df217c9d11134692734357ed7ddcd6c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that leverages the Equation Editor vulnerability (CLSID identified by RTF_EQUATION_EDITOR). The ".objupdate" directive indicates that the embedded object is designed to activate automatically, triggering the exploit. This is a common delivery mechanism for malware that aims to download and execute further stages.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000ecb.bin` `a59136898593d7fe06d4e1910cdf8509e9691dbe139b2e4933607acbc61c8898`	rtf-objdata-decoded	RTF \objdata at offset 0xECB	4185 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.