MALICIOUS
262
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The RTF document contains OLE objects and triggers OLE activation via \objupdate, indicating an attempt to exploit vulnerabilities. Specifically, the CVE-2017-8759 heuristic firing strongly suggests exploitation of MSXML SAX OLE activation. The embedded INCLUDETEXT/INCLUDEPICTURE object points to a remote URL, 'http://todpot.tk/0346/t.php?stats=send&thread=0', which is likely used to download and execute a second-stage payload. The ClamAV detection as Rtf.Downloader further supports this conclusion.
Heuristics 7
-
CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
-
ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
-
PEB access via FS segment (x86) high SC_PEB_ACCESSPEB access via FS segment (x86)
Disassembly
Attempted x86 opcode disassembly00013784 64a130000000 mov eax, dword ptr fs:[0x30] 0001378A 56 push esi 0001378B be05000000 mov esi, 5 00013790 5e pop esi 00013791 8b400c mov eax, dword ptr [eax + 0xc] 00013794 9b wait 00013795 8b4014 mov eax, dword ptr [eax + 0x14] 00013798 90 nop 00013799 8b4014 mov eax, dword ptr [eax + 0x14] 0001379C 56 push esi 0001379D be96000000 mov esi, 0x96 000137A2 5e pop esi 000137A3 48 dec eax 000137A4 668138ff25 cmp word ptr [eax], 0x25ff 000137A9 75f8 jne 0x137a3 000137AB 56 push esi 000137AC be4f000000 mov esi, 0x4f 000137B1 5e pop esi 000137B2 8b4002 mov eax, dword ptr [eax + 2] 000137B5 9b wait 000137B6 8b00 mov eax, dword ptr [eax] 000137B8 83e801 sub eax, 1 000137BB 83c001 add eax, 1 000137BE 40 inc eax 000137BF bb0c247c8b mov ebx, 0x8b7c240c 000137C4 0fcb bswap ebx 000137C6 3918 cmp dword ptr [eax], ebx 000137C8 75f4 jne 0x137be 000137CA 81780485ff7c08 cmp dword ptr [eax + 4], 0x87cff85 000137D1 75eb jne 0x137be 000137D3 90 nop 000137D4 83e802 sub eax, 2 000137D7 e9fa000000 jmp 0x138d6 000137DC 0000 add byte ptr [eax], al 000137DE 0000 add byte ptr [eax], al 000137E0 0000 add byte ptr [eax], al 000137E2 0000 add byte ptr [eax], al
-
\objupdate forces OLE activation high RTF_OBJUPDATERTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
-
INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTERTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// URL — Word can fetch the remote content on open depending on Office version and external-content settings, enabling remote template injection, NTLM capture via redirects, or payload delivery
-
OLE object data medium RTF_OBJDATARTF contains 2 \objdata section(s) — embedded OLE objects
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://todpot.tk/0346/t.php?stats=send&thread=0 In RTF body
- http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objdata_00_off0000c568.bin |
rtf-objdata-decoded | RTF \objdata at offset 0xC568 | 2598 bytes |
SHA-256: 958c6a347deec34fdbed67e065f04e9c575f0e13a93ace15782bd6899a1c92b4 |
|||
objdata_01_off0000dc96.bin |
rtf-objdata-decoded | RTF \objdata at offset 0xDC96 | 2723 bytes |
SHA-256: 0434dece3b60573ec8eb06a6a1d5a15200f352756c38de5d8672232bb14b3ada |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.