Rtf.Dropper.Agent-7384550-0 — RTF malware analysis

Static analysis result for SHA-256 2a02a0bd43572544…

MALICIOUS

RTF

429.2 KB Created: 2019-06-19 10:51:00 First seen: 2019-09-30
MD5: 3d5baa8163dae270032503f35affb39d SHA-1: 5f5ff3f23a800b4eec349f94346c0fc6f04476a6 SHA-256: 2a02a0bd4357254450614961d1f2306de7523dd31707483bb10d21427d7ae83a
202 Risk Score

Malware Insights

Rtf.Dropper.Agent-7384550-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an embedded OLE object that is activated via \objupdate, exploiting CVE-2017-8759. This technique is commonly used by droppers to download and execute additional malware. ClamAV identified the sample as Rtf.Dropper.Agent-7384550-0, supporting its role as a dropper.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Xls.Dropper.Agent-7057793-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-7057793-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 7 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002ce1.bin rtf-objdata-decoded RTF \objdata at offset 0x2CE1 16955 bytes
SHA-256: 0353939f193de8059a99a326b9d3f48dac3e47a4ffdfc3a0b7487b422e0987ff
objdata_01_off00010aca.bin rtf-objdata-decoded RTF \objdata at offset 0x10ACA 16955 bytes
SHA-256: d2b635b2e11e157ba8289cdd6390d01c6bb6781a9ce984a1b4c1b7cd21c7ea57
objdata_02_off0001e8b3.bin rtf-objdata-decoded RTF \objdata at offset 0x1E8B3 16955 bytes
SHA-256: 88a77d646daae36ee338c6694ae13fe1a8592ec1017cd11ea95667fe9355a8c8
objdata_03_off0002c69c.bin rtf-objdata-decoded RTF \objdata at offset 0x2C69C 16955 bytes
SHA-256: cbc77cd1aec96274b90a823829705b460d90385664ff4da4c0dbd9db5bbda05a
objdata_04_off0003a485.bin rtf-objdata-decoded RTF \objdata at offset 0x3A485 16955 bytes
SHA-256: 9d63d5399e532ccd6b1538b88b7f9540e331562a64c0130970b7d99727c385ae
objdata_05_off0004826e.bin rtf-objdata-decoded RTF \objdata at offset 0x4826E 16955 bytes
SHA-256: b45a202f89a39fb2c8d8247514776a6614af27d8a0eac5b842b8a6d6b2c96981
objdata_06_off00056057.bin rtf-objdata-decoded RTF \objdata at offset 0x56057 16955 bytes
SHA-256: 90c16da69fa283ceb3818f133908a5f0c2a05117a55956a754035a98a23f16ca

Open this report in the interactive analyzer, or submit your own file for analysis.