Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 f889a5010f912f64…

MALICIOUS

RTF / .DOC

10.5 KB First seen: 2022-04-01
MD5: 0fb08700bd94d2054e8ebf16603b01fe SHA-1: eda02fd5bc4152ab8b2533fe0d73b9611067c3e6 SHA-256: f889a5010f912f6477f7c15cc313a55c0aaf5c19d08b4597ab40984886a58ea3
121 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.001 Command and Scripting Interpreter: PowerShell

The sample is an RTF document that contains embedded OLE objects and triggers an update via \objupdate, indicating an attempt to exploit a vulnerability. Specifically, the RTF_EQUATION_EDITOR heuristic firing points to a known exploit targeting the Equation Editor component. This exploit likely leads to the download and execution of a second-stage payload, although no specific URLs or scripts were extracted to confirm this. The confidence is high due to the critical heuristic firing.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00001a53.bin
00184469f672ccc1ec7161ba8f1ed58d67311d4cbbdf81fd2adef03084914f3f
rtf-objdata-decoded RTF \objdata at offset 0x1A53 1857 bytes