RTF malware analysis — malicious · faf2726fe7402547

MALICIOUS

RTF

304.1 KB First seen: 2020-06-01

MD5: bcbbea9a72e86412732fe11b46760c34 SHA-1: a3e730ab0a66e8b848f2b606ac045509dc8b814f SHA-256: faf2726fe74025478a18871f46d0228b83d2b37ec0c522bef07320d66192747f

140 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains an embedded OLE object with high entropy, identified as a potential Equation Editor exploit (CVE-2017-11882). The presence of \objupdate indicates an attempt to force OLE activation, leading to the execution of the embedded payload. The extracted artifact objdata_00_off00000083.bin is likely the shellcode payload.

Heuristics 4

Equation Editor OLE1 native payload — CVE-2017-11882 related critical CVE related CVE_2017_11882_RELATED

RTF decodes to an OLE1 Equation.3 embedded object whose native data is large and payload-like, and \objupdate requests automatic activation. This is the delivery shape used by Equation Editor RCE documents such as CVE-2017-11882/CVE-2018-0802, but the malformed MTEF record needed for exact attribution was not recovered.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000083.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x83	155624 bytes
SHA-256: `7c8891f149584c09397240fbf5b19304f9cdb594ae36cf38fa6bd9236ac618f1`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_GETPC_CALL Carved artifact entropy is 8.00, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.