---
id: 7428
title: "Phân tích mẫu mã độc khai thác lỗ hổng Microsoft Office Equation Editor."
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/phan-tich-mau-ma-doc-khai-thac-lo-hong-microsoft-office-equation-editor/"
published_at: "2019-11-19T10:39:40Z"
tags: ["malware-analysis", "shellcode", "cve-2017-11882", "cve-2018-0802", "equation-editor", "rtf", "qiling"]
phying_url: "https://phying.com/item/7428"
lang: en
---

# Phân tích mẫu mã độc khai thác lỗ hổng Microsoft Office Equation Editor.

## Summary

Analysis of an RTF sample abusing Microsoft Office Equation Editor bugs CVE-2017-11882 and CVE-2018-0802: it drops adcache.dll, checks a killswitch and runs shellcode, traced with Qiling.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2019-11-19T10:39:40Z
- **Original:** https://blog.viettelcybersecurity.com/phan-tich-mau-ma-doc-khai-thac-lo-hong-microsoft-office-equation-editor/
- **Phying News:** https://phying.com/item/7428