RTF malware analysis — malicious · 27148d4ac958c28d

MALICIOUS

RTF

5.3 KB First seen: 2017-10-10

MD5: c5c14e5a90e29b19e26a0433cc8e9ce1 SHA-1: 57e4dc59a375429d7974e78516d45634c3e0c5d4 SHA-256: 27148d4ac958c28d97c233b18b88147f5c77a1907ee487a0c08e84e608b34cf9

202 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF file identified by ClamAV as Rtf.Exploit.CVE_2017_0199-6331394-6, indicating exploitation of CVE-2017-0199. Heuristics confirm the presence of OLE object data, automatic linking, and URL moniker usage, all indicative of a malicious RTF exploit. The exploit likely facilitates the download and execution of a secondary payload, consistent with spearphishing attachment tactics.

Heuristics 6

URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED

RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
ClamAV: Rtf.Exploit.CVE_2017_0199-6331394-6 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_0199-6331394-6
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000001ab.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1AB	2133 bytes
SHA-256: `fcdee470f386853f0acd18509606ec097e7a823925f6ae576ab50ea9e48d2f5d`

Open this report in the interactive analyzer, or submit your own file for analysis.