This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.
Topic 4.5 of Malicious Web & Document Files
RTF file structure, five reasons attackers prefer RTF, CVE-2017-11882 and CVE-2017-0199 exploitation chains, rtfobj extraction, scdbg shellcode emulation, and high-risk indicator recognition.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
Downloadable reference material
External links
oletools — rtfobj and olevba
Python package containing rtfobj, olevba, oleid, and other Office/RTF analysis tools. Install via pip in REMnux or FlareVM.
scdbg — Shellcode Debugger
Free shellcode emulator. Run extracted OLE shellcode safely to recover download URLs, drop paths, and execution methods.
NVD — CVE-2017-11882
Official NVD entry for the Equation Editor buffer overflow vulnerability with CVSS score and reference links.
Quadrant 4 · Self-Assessment
Malicious Web & Document Files
Covers drive-by download attacks, JavaScript de-obfuscation, malicious PDF analysis, RTF exploitation, and Microsoft Office macro malware.
REMA Complete Assessment
A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.
