Malicious RTF — malware analysis report

Static analysis result for SHA-256 fc22adca75153616…

MALICIOUS

RTF

34.8 KB First seen: 2023-06-01
MD5: f444eefc2067791f77e8dea8336ede2e SHA-1: 1447068a5aa6a4ca1d0835d9e8ee836108c73228 SHA-256: fc22adca75153616c63425b6044dc81768874d2246cce3a43b4f0515575df29e
140 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059 Command and Scripting Interpreter

The RTF file contains OLE object data and specifically targets the Equation Editor, a known vulnerability vector. The presence of \objupdate indicates an attempt to automatically activate the embedded object. The document body includes a lure instructing the user to 'Enable editing', which is a common tactic to bypass security measures and trigger the exploit. The primary goal appears to be the execution of a secondary payload via the Equation Editor vulnerability.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00005a43.bin
f3fe119f453fccdaf923ba8e91c41066c33aa9446998c2240db0e6653d4cd4ec
rtf-objdata-decoded RTF \objdata at offset 0x5A43 1578 bytes