RTF / .DOC malware analysis — malicious · e78c379150f1d1db

MALICIOUS

RTF / .DOC

334.3 KB

MD5: e878302e18fbbf24520dbad1f2105a60 SHA-1: 4d813861b68c8fb3c7c9263eef2de8224521bf28 SHA-256: e78c379150f1d1dbb3f655d2df110a160462ee3f6a8c9fa73a1ba9f0e65f0907

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Compromise T1566.001 Privilege Escalation T1071.002 Remote Services Execution T1105 System Information Discovery T1071.003 Application Return - Malicious Code

The file's structure, particularly the use of extit{objdata}, extit{objemb}, extit{objautlink}, and extit{objupdate} control words within the RTF document, strongly indicates a malicious OLE object dropper. The document attempts to trigger the automatic instantiation of a vulnerable OLE object (likely related to CVE-2017-8570 Equation Editor) upon opening, bypassing macro security settings to execute a payload. The presence of a Composite Moniker further suggests an attempt to exploit a vulnerability associated with that identifier. The document's instruction to enable macros or editing is a common tactic used to bypass security measures.

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000965.bin` `004828caef8228e7b1134ccb67024690613441df5d057f43f16dc74bcc5a947f`	rtf-objdata-decoded	RTF \objdata at offset 0x965	59595 bytes
`objdata_01_off00007114.bin` `785626791804784c248dad94f84ad5088f35ce2d01e25c26756b3fc7a9554623`	rtf-objdata-decoded	RTF \objdata at offset 0x7114	59568 bytes
`objdata_02_off000255b3.bin` `a8e170497da15decc11753d202c99c86f7a7ffd2d52481e6b9c79a5403675379`	rtf-objdata-decoded	RTF \objdata at offset 0x255B3	2632 bytes
`objdata_03_off00026b56.bin` `e8d4fe950caed6dcfde26f4b616825bbe11b93458425974b7d075167f675abf7`	rtf-objdata-decoded	RTF \objdata at offset 0x26B56	12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.