Malicious RTF — malware analysis report

Static analysis result for SHA-256 ee45616bc065da00…

MALICIOUS

RTF

3.7 KB
MD5: 7555231748e634ec3a8bd8cc4528ffd2 SHA-1: 3fdb0a0d1c6b2c1e4e6997d8bc9c5005f9226eb2 SHA-256: ee45616bc065da00d71a34fdf4f0050d861de92d650abc97db482f63921ca7ef
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains embedded OLE objects and specifically triggers the Equation Editor vulnerability. The presence of \objupdate indicates an attempt to force OLE activation, leading to the exploitation of the Equation Editor to execute arbitrary code. This is a common technique for delivering malicious payloads.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000096.bin
3485df2dd8feeb6c86f3bb087b51d7d5a4c4d0ea244b216fac26b85b16bcd596		 rtf-objdata-decoded RTF \objdata at offset 0x96 1694 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.