Doc.Dropper.Agent-6547889-0 — RTF malware analysis

Static analysis result for SHA-256 096af3e4f3d7d143…

MALICIOUS

RTF

711.2 KB Created: 2018-04-22 03:19:00 First seen: 2018-05-18
MD5: 78f19d1f8b609e1152670049da7e9e21 SHA-1: 428665f91d8fef358efef96ae4d127f56fd1f120 SHA-256: 096af3e4f3d7d1431d075a9d5998ab713279f9729b1dd075569d23e15cf1fd66
262 Risk Score

Malware Insights

Doc.Dropper.Agent-6547889-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an ".objupdate" command, indicating an attempt to activate them. The critical heuristic firing for CVE-2017-8759 confirms exploitation of this vulnerability via MSXML SAX OLE activation. ClamAV detection as 'Doc.Dropper.Agent-6547889-0' further supports its malicious nature as a dropper. The embedded OLE object is likely used to download and execute a secondary payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Doc.Dropper.Agent-6516028-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6516028-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c45.bin rtf-objdata-decoded RTF \objdata at offset 0x2C45 21051 bytes
SHA-256: 20276bf4d5fa0aa948c601f25128ced7d0248f8018200a8eba6e225ffbace8df
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_01_off00012bb0.bin rtf-objdata-decoded RTF \objdata at offset 0x12BB0 21051 bytes
SHA-256: 9aad95c8d47b1248a141a1d93e65c9df79d366da0152f797d735b6d867017f7e
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_02_off00022b1b.bin rtf-objdata-decoded RTF \objdata at offset 0x22B1B 21051 bytes
SHA-256: 120261f223bce51aae25e708fb609ac0bd4b903af5d5c7e5abb3adb61c6a1577
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_03_off00032a86.bin rtf-objdata-decoded RTF \objdata at offset 0x32A86 21051 bytes
SHA-256: dade3c48ab36d7b2eda01a065c08e30e80e2ab96c0b3698e61b4843b6d1f83aa
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_04_off000429f1.bin rtf-objdata-decoded RTF \objdata at offset 0x429F1 21051 bytes
SHA-256: 7e5abc81c4a8907de37243c6db993f7b6ef25097a0f202c4c02cb57c7ce66a6d
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_05_off00052963.bin rtf-objdata-decoded RTF \objdata at offset 0x52963 21051 bytes
SHA-256: b8481ce6f8c864b7de139dd2c8aeceac18f475a15fbf906879e3f14e2fb0ab76
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_06_off000628ce.bin rtf-objdata-decoded RTF \objdata at offset 0x628CE 21051 bytes
SHA-256: a5e73f28190c56a1d3fae4f87b24dbb15bba890612311c8c554a27c7347ec252
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_07_off00072839.bin rtf-objdata-decoded RTF \objdata at offset 0x72839 21051 bytes
SHA-256: 2d373794b3559b9be5efa66d1f81a54885d79abe5e10f0208af8192856ce67f4
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_08_off000827a4.bin rtf-objdata-decoded RTF \objdata at offset 0x827A4 21051 bytes
SHA-256: c1949e91ecae041e6cce8490ad3a31afd4d86a1217232d7577c3ba386d37dca9
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely
objdata_09_off0009270f.bin rtf-objdata-decoded RTF \objdata at offset 0x9270F 21051 bytes
SHA-256: 74cb29561e021287ebb77750e956d113e5f7f44ff029bcc4a1910b5b7b83df7d
Detection
ClamAV: Doc.Dropper.Agent-6516028-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.