equation editor exploit RTF / .DOC malware analysis — malicious · dcde17e3cfe69ac2

MALICIOUS

RTF / .DOC

8.2 KB

MD5: 4d64b8bd0fd2a18ca0ec93bbc1595608 SHA-1: d435d3971d39e87f1619f61fc3454b24a656cba6 SHA-256: dcde17e3cfe69ac2ccabf6e4725490d5b715eba7454d9fa859dde428a11f4649

120 Risk Score

Malware Insights

equation editor exploit · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The RTF file contains an embedded OLE object with a CLSID indicative of the Equation Editor. The \objupdate directive forces the activation of this object, triggering an exploit. This is a known method for delivering malicious payloads, often leading to arbitrary code execution.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000036.bin` `5b4de44ae9980d6f5ab3977d6619d2d6fc6c4af353e7f350c7b0a450323dd3b6`	rtf-objdata-decoded	RTF \objdata at offset 0x36	4141 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.