Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 ec8cf36bb41e46da…

MALICIOUS

RTF / .DOC

886.1 KB First seen: 2024-05-18
MD5: caa9f603002287d041a1641a5e5a66d2 SHA-1: afe5f96a59811fac0e2e323484f94d6a46c9c581 SHA-256: ec8cf36bb41e46da1b22f22eef094097a002622ec62f1facb4357c677c8066e1
122 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1559.001 Component Object Model Hijacking

The RTF document contains an OLE object with a split Equation Editor ProgID, indicating an attempt to exploit a known vulnerability. The \objupdate directive further suggests that the embedded object is designed to be activated automatically upon opening the document, leading to arbitrary code execution. The extracted file hash is provided as an IOC.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000131.bin
8f83def46e4b95be2758f233516deeec2b96e7eea891a98aa229c94be84e4b30
rtf-objdata-decoded RTF \objdata at offset 0x131 453367 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 8.00, consistent with packed or encrypted content.