Microsoft Office Russian Dolls, (Fri, Nov 14th)

The author describes a malicious Word (OOXML) document that contains an embedded RTF which exploits CVE-2017-11882 (Equation Editor) to execute shellcode and drop an obfuscated DLL (noted hash and Temp path). The analysis includes zip listing, relationship entries referencing the RTF, the rundll32 invocation used to execute the DLL, and sample indicators for detection.