RTF malware analysis — malicious · 0941eb1a7142e0e8

MALICIOUS

RTF

1.07 MB Created: 2018-05-10 15:46:00 First seen: 2018-06-14

MD5: 9cc28c693974f62421618f315fa972a2 SHA-1: f530ef2d44784b3c843190d883c65ffad07e3c8b SHA-256: 0941eb1a7142e0e8b9aca8b1f051b764d226201745f65733f49b4a5383ce088e

302 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects with excessive hex-encoded data, and the ".objupdate" directive forces OLE activation. Crucially, the heuristic firing for CVE-2017-8759 indicates exploitation of this vulnerability via MSXML SAX OLE activation. This suggests the file is designed to execute arbitrary code by leveraging this known vulnerability, likely as a downloader for further malicious activity.

Heuristics 7

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1035KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 12 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 12

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002c1d.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2C1D	33339 bytes
SHA-256: `8b0250aad7b07eb49089c081d9f22d5bf417a50a571626e5d6890980cf742dfa`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_01_off00018b39.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x18B39	33339 bytes
SHA-256: `48800c38886676de07b5d4e72b7d2b6c04098eb36ad3ce4e55eac47cac448098`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_02_off0002ea55.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2EA55	33339 bytes
SHA-256: `ecb18f216259827f38179833d322b576b47153082e3d7fa8b5fede11a40461ed`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_03_off00044971.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x44971	33339 bytes
SHA-256: `a759ec8493d58a9e590b125bee8ad2dfb63141f431c0c8e9b74d9f3107069c6a`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_04_off0005a88d.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5A88D	33339 bytes
SHA-256: `1cac943aa8c9945fe9ceb684f2fab35e6cdd2ed5fe0f22435e4c05484cbaff83`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_05_off000707a9.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x707A9	33339 bytes
SHA-256: `8bc1204ede631e2f027316e89504641d1248a3a6b3cc77582a7804d02d2f9edf`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_06_off00086718.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x86718	33339 bytes
SHA-256: `13b704fd71aad8d35d7e8bd55d3a980b28b91693566086ee4b614b671af3fd7b`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_07_off0009c634.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x9C634	33339 bytes
SHA-256: `702ee6099bb3107d516ef23d3d516e988e0b6a57c65380151c27782195a042c8`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_08_off000b2550.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xB2550	33339 bytes
SHA-256: `b6b6664c2769fda14bc43d24f042cc5bf3a5208dfd617b70c859a89ca1962663`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_09_off000c846c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC846C	33339 bytes
SHA-256: `e183b32af475687914b47a3c98243367cdbccef56bd251bb3e5897553af02cb2`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_10_off000de388.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDE388	33339 bytes
SHA-256: `595d1befa00ec5716201ee1c928a921c20ea98231d3d21a48372cfc6df2daa49`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely
`objdata_11_off000f42a4.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xF42A4	33339 bytes
SHA-256: `c3569a7bbef59eb615fb2add9b80c15ab60fc8be3624116be8b76c5c30171eb5`
Detection ClamAV: Doc.Dropper.Agent-6412232-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.