RTF malware analysis — malicious · dda11497d1348934

MALICIOUS

RTF

14.0 KB

MD5: 0da3efe7e213d8b0d3dca9e9502534cc SHA-1: 3bceffd17999232995b0e9bf0561b8d26c20d2f7 SHA-256: dda11497d1348934476e5806d133a7b2bc25696cef6f1ab82ed808766e7aedca

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF file contains an embedded OLE object that leverages the Equation Editor vulnerability (RTF_EQUATION_EDITOR). The ".objupdate" heuristic indicates that the embedded object is designed to be activated automatically, which is a common technique for exploiting vulnerabilities in document formats. The presence of RTF_OBJDATA further confirms the embedding of external data. While no specific scripts or URLs were extracted, the exploit chain strongly suggests the document's purpose is to download and execute a secondary payload.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000819.bin` `ebacb95e04956ccf07d88189a8f60d551a6478b226bbd3aa1751151f753ece1d`	rtf-objdata-decoded	RTF \objdata at offset 0x819	4709 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.