Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 dcb57924e1896ccb…

MALICIOUS

RTF / .DOC

16.7 KB First seen: 2022-08-25
MD5: 7ff3e677f08929528795799d55a562e5 SHA-1: 89dda5ecd0807606604812f2fb6a7e4a7f9057ed SHA-256: dcb57924e1896ccbe3e64b49762089fd69770043c1bab570f35deeaa8c6c4053
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059 Command and Scripting Interpreter

The sample is an RTF document containing OLE object data, specifically triggering heuristics related to Equation Editor vulnerabilities and OLE activation. The presence of ".objdata" and "Ole10Native" streams indicates embedded objects designed to be activated. The heuristic "SE_ENABLE_LURE" suggests the document prompts the user to enable content, a common lure for macro-based malware delivery. The attack likely involves exploiting the Equation Editor to download and execute a secondary payload.

Heuristics 5

  • Ole10Native stream in RTF OLE object high CVE related RTF_OLE10NATIVE_STREAM
    RTF contains an embedded OLE object with an Ole10Native stream. This is a strong payload-container signal and is related to Word/OLE exploit delivery, but it is not specific enough on its own to assign a CVE.
  • Equation Editor CLSID critical RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000e89.bin
59e4346fb4bb067b2d9461c3e4108c47531adff9e81a9b87a79fa1d72e409e64
rtf-objdata-decoded RTF \objdata at offset 0xE89 4276 bytes