Rtf.Dropper.Agent-8079298-0 — RTF malware analysis

Static analysis result for SHA-256 e40a12e6e64fdd06…

MALICIOUS

RTF

930.5 KB First seen: 2020-07-24
MD5: 3ad91b31956ce49fe3736c0e7344228d SHA-1: 9378c09a90df28affb61371ffbad04d2dd1ae5b8 SHA-256: e40a12e6e64fdd06abe843b2e70bfc59c279923cec7bc47f8c8964b4d7a53b7b
260 Risk Score

Malware Insights

Rtf.Dropper.Agent-8079298-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document containing an embedded OLE object that exploits the Equation Editor vulnerability (CVE-2017-11882). This vulnerability is known to be used to execute arbitrary code, likely to download and run a secondary payload. The ClamAV detection name 'Rtf.Dropper.Agent-8079298-0' further supports its role as a dropper.

Heuristics 7

  • Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED
    RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
  • ClamAV: Rtf.Dropper.Agent-8079298-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-8079298-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0004652b.bin rtf-objdata-decoded RTF \objdata at offset 0x4652B 330624 bytes
SHA-256: f3d73adef9e4a4be386002456247c88af27035cbef4f8338bfe6d43e677dbe49
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x41 (A) Carved artifact contains 1 shell/COM execution token(s).
objdata_01_off000e7c53.bin rtf-objdata-decoded RTF \objdata at offset 0xE7C53 1709 bytes
SHA-256: 6ef048de06e9c2e6b420e78a489e52123766b08549a074a5f95b98ffe8558f38
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS
objdata_02_off000e7c63.bin rtf-objdata-decoded RTF \objdata at offset 0xE7C63 36 bytes
SHA-256: 8935eb605040753f89379b3f05c2cdaefba833ec64299ed9c258020f4c1217b0

Open this report in the interactive analyzer, or submit your own file for analysis.