Malicious RTF — malware analysis report

Static analysis result for SHA-256 04bbd58d7b27cd48…

MALICIOUS

RTF

732.6 KB Created: 2018-04-27 02:03:00 First seen: 2018-06-14
MD5: 8cf518e7e34e5f6754f5bb603ed1951b SHA-1: eb1c807b5e8a7ef6579605145495e55917cdc095 SHA-256: 04bbd58d7b27cd48309c856ee96520aff4ff9149eaf4fe6ae0e14e4ad993cce9
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an ".objupdate" command, which is indicative of exploiting vulnerabilities like CVE-2017-8759 for client execution. ClamAV detections further confirm its malicious nature, flagging it as Doc.Macro.Obfuscation. The primary attack vector is likely spearphishing attachment, with the embedded OLE object serving as the mechanism to download and execute a secondary payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c11.bin rtf-objdata-decoded RTF \objdata at offset 0x2C11 24123 bytes
SHA-256: b7788f55bb945ab578c7cf0a8af807412f085dc18856a54cf3e9124247e47af9
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_01_off000140e1.bin rtf-objdata-decoded RTF \objdata at offset 0x140E1 24123 bytes
SHA-256: 4a12dd4d2d952085163a9919a7f828e77a0480846447eab55ff6f511f56d53f9
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_06_off0006a8f8.bin rtf-objdata-decoded RTF \objdata at offset 0x6A8F8 24123 bytes
SHA-256: 6d18c38dba95ae040d82a83528a64c7418b9987e7d2719dacca753f1fc59c0b1
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_07_off0007bdc8.bin rtf-objdata-decoded RTF \objdata at offset 0x7BDC8 24123 bytes
SHA-256: e795f611158d9a7cc23a457a55382a0ae6985d6071c4a791c3f09e5519dd7a08
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_08_off0008d298.bin rtf-objdata-decoded RTF \objdata at offset 0x8D298 24123 bytes
SHA-256: b345fed3b8ae6e2c974733dfb27c0b60b584e640c19663c9abb7d62b6eb29b01
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.