Malicious RTF — malware analysis report

Static analysis result for SHA-256 f160c6e7062514a7…

MALICIOUS

RTF

3.8 KB First seen: 2019-05-10
MD5: 8ab27043c494c6a4f869b95b7c8c4469 SHA-1: f1e1f19650ffc2fa7a7180a09661d18fe9de234a SHA-256: f160c6e7062514a7083f8798c3bde0712df13611397b2e213a9a85f6f8344af1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document containing OLE object data, specifically triggering heuristics related to the Equation Editor vulnerability. This indicates the file is designed to exploit CVE-2017-11882 to achieve code execution. The presence of OLE object data and the ".objupdate" directive strongly suggest the embedded object is intended to be activated, likely to download and execute a secondary payload. The file's SHA256 hash is provided as an IOC.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000003c.bin rtf-objdata-decoded RTF \objdata at offset 0x3C 1904 bytes
SHA-256: a7c9d0165b4b596f98f8f7b93753a38886f689077d94f5e3b72b675aad8a5dc9

Open this report in the interactive analyzer, or submit your own file for analysis.