RTF malware analysis — malicious · ea87f3d339f1503e

MALICIOUS

RTF

232.5 KB First seen: 2024-10-09

MD5: 56a6c0261a72db745ea0f21a3c55c675 SHA-1: 3a7b8465d5256b4b9c6d50fc0452a641ab4abe09 SHA-256: ea87f3d339f1503e2544d94168480a3085ea9cf379bf8e397a7c08ecebdaaa8b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The critical heuristic firing for CVE-2017_11882 indicates the file is designed to exploit a known vulnerability in the Microsoft Equation Editor. The RTF_OBJDATA and RTF_OBJUPDATE heuristics further suggest the presence and activation of embedded OLE objects, which is a common delivery mechanism for this exploit. The exploit likely leads to the execution of a secondary payload, although no specific details of this payload were extracted.

Heuristics 3

CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882

Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000210f.bin` `4a6920acff01b5afa3dd84ad523647932e3f4d86adddb66bf5d7239358cb890a`	rtf-objdata-decoded	RTF \objdata at offset 0x210F	4787 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.