Malicious RTF — malware analysis report

Static analysis result for SHA-256 329c3b1c04a4b64a…

MALICIOUS

RTF

1.49 MB First seen: 2019-01-11
MD5: 566c2c6c5c45306f03831e2c656267ec SHA-1: 689b81989a8bffcc5674f9389fd233348be46f08 SHA-256: 329c3b1c04a4b64aa1f20adf2d8df0d409a0d8e816acf3f29e497d3b1946808b
262 Risk Score

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1567KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 6 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://test1.ru/newbuild/t.php?act=hit In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000222e2.bin rtf-objdata-decoded RTF \objdata at offset 0x222E2 885 bytes
SHA-256: 7d5f88680e60b61c3804b4e958745d940ae073cb6f167cc9e0d1a27e8996ab45
objdata_01_off000229ff.bin rtf-objdata-decoded RTF \objdata at offset 0x229FF 32665 bytes
SHA-256: 7bc9ec1f0f651f44d55c29c2418a62c6073ac32e2c7b9aaefcfd115ed3f57211
objdata_02_off00032963.bin rtf-objdata-decoded RTF \objdata at offset 0x32963 464 bytes
SHA-256: e703848bebd5a70ed3890f101964afa809d470068426f899f139fe667cfa40f0
objdata_03_off00032d37.bin rtf-objdata-decoded RTF \objdata at offset 0x32D37 820 bytes
SHA-256: d6e0de80a1802cce16fd208d08beb938c29c6d62984b89d9b3f972281ec4f244
objdata_04_off00033406.bin rtf-objdata-decoded RTF \objdata at offset 0x33406 2633 bytes
SHA-256: fe11c27d916ab897eb94064e9631d8a29c847a6db39259bef31578da8d19fdf5
objdata_05_off000348e0.bin rtf-objdata-decoded RTF \objdata at offset 0x348E0 676044 bytes
SHA-256: c58fd456f0b72a4486289a967471f4148e1be3e2ea62fb221ddde5fa193087d5

Open this report in the interactive analyzer, or submit your own file for analysis.