CVE-2017-11882 is a memory corruption flaw in the old Equation Editor component bundled with Microsoft Office. A crafted document runs code as the current user, which is why it stayed in phishing kits for years despite being patched.
Reading the RTF
Opening the file in a text editor shows only junk. An RTF parser such as rtfdump.py lists the embedded objects, and dumping the relevant one in hex shows the Equation.3 class and some obfuscated strings.
rtfdump.py sample.rtf list all objects
rtfdump.py sample.rtf -s <n> -H show object <n> as hex
look for: Equation.3, an OLE header, long obfuscated string
What happens when it opens
Office starts the legacy EQNEDT32.EXE. That process, not Word, makes the network connection and downloads an executable which is stored in the Internet Explorer cache path under a random folder, in this case as a random-named EXE.
WINWORD.EXE
`- EQNEDT32.EXE (Common Files\Microsoft Shared\EQUATION)
`- download -> ...\Temporary Internet Files\Content.IE5\<rand>\<name>.exe
`- payload runs
The dropped payload
A .NET assembly. Its packer decrypts a resource and loads a second DLL layer with reflection. The second stage then does a lot of environment checks.
looks for SbieDll.dll (Sandboxie)
VMware / VIRTUAL strings
sleeps in loops, many window and user calls (watching for human activity)
IsDebuggerPresent, process heap flags
sets its own exception handler, creates guard pages
creates a suspended process and writes a PE into it
reads volume, CPU and user name details
Sample hashes
rtf b7ca78c34ecde019d8495ffac28c0f3e849aa816a772b80857a9b48b57fbae26
payload aaa9238df6ef9366c0db7ad8cc588cf6770da687cbab9a64013c0f77d69b5686
Defensive note
If Equation Editor is not needed, disable or remove it and install the November 2017 patch. EQNEDT32.EXE making any outbound connection is a very strong alert.