Malicious RTF — malware analysis report

Static analysis result for SHA-256 2a8410b31c50f966…

MALICIOUS

RTF

675.4 KB Created: 2017-11-02 10:38:00 First seen: 2018-01-23
MD5: 4311cd01ecc9c82910189123e6ced48e SHA-1: 057bc11568bfe35713d5034daa4a9850ce008389 SHA-256: 2a8410b31c50f966704f0abb5a976f0faf59604116c4a4908992b33bb9dc4e19
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects, with heuristics indicating that \objupdate forces OLE activation. Critically, the CVE-2017-8759 exploit is detected, which targets MSXML SAX OLE activation. This suggests the file is designed to exploit this vulnerability to execute arbitrary code, likely by downloading and running a second-stage payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002a8c.bin rtf-objdata-decoded RTF \objdata at offset 0x2A8C 21057 bytes
SHA-256: 17b2ac34723a3f5a4649788a48d90ba7693e3ac3efbfc7d0755e6f322c38fb1d
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_01_off0001289d.bin rtf-objdata-decoded RTF \objdata at offset 0x1289D 21057 bytes
SHA-256: ea77bd719c5bff13fa15463f02499862b984189a15f06aad4efd518a9547e7fa
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_02_off000226b0.bin rtf-objdata-decoded RTF \objdata at offset 0x226B0 21057 bytes
SHA-256: 6bb290e7cf7ab12dabdb57c46cc0019526fa363223c496fb58e5a6f14b65b659
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_03_off000324c3.bin rtf-objdata-decoded RTF \objdata at offset 0x324C3 21057 bytes
SHA-256: 64384e70f897924bddd3d668ce13fe7b75da9968d2726f479136147ca8ee07dc
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_04_off000422d6.bin rtf-objdata-decoded RTF \objdata at offset 0x422D6 21057 bytes
SHA-256: dfdbae372fb9d79906b47bfd544d8bccccb9b5fb8514bfcdb192947c3d9c7f05
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_05_off000520e9.bin rtf-objdata-decoded RTF \objdata at offset 0x520E9 21057 bytes
SHA-256: 07fb0a82679a5bc05b5130d1ab0cd4b30213fa88b7288b7b363520a11c94455c
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_06_off00061efc.bin rtf-objdata-decoded RTF \objdata at offset 0x61EFC 21057 bytes
SHA-256: 1fc64433944bc4ef63980d237f880e739f04542568e34032df7842e17eabdbf0
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_07_off00071d0f.bin rtf-objdata-decoded RTF \objdata at offset 0x71D0F 21057 bytes
SHA-256: 7fa98c4e92196c218beb58169eb335821358434b018c2785597915106c59799a
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_08_off00081b22.bin rtf-objdata-decoded RTF \objdata at offset 0x81B22 21057 bytes
SHA-256: 6c4821abebe71d3909bbc77c017515582e86996a8a799277984d4afce0763786
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_09_off00091935.bin rtf-objdata-decoded RTF \objdata at offset 0x91935 21057 bytes
SHA-256: c953530c419a818f95ac63bf11df5ef03354072e13ae9f45791d84dd3c4f16c1
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.