RTF malware analysis — malicious · 38204738e9059f46

MALICIOUS

RTF

408.4 KB First seen: 2019-01-12

MD5: efa3e6c05ba07866de93f8e214860e7f SHA-1: ee8f770b4a1c691e2e97a0b63463dbe756afcf4f SHA-256: 38204738e9059f46427b6dd2bcc2883b5539d39f2d2edcdb60d708e19dc50495

344 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains multiple indicators of exploitation, including composite monikers and OLE object data, strongly suggesting the use of CVE-2017-8570. This vulnerability is known to drop and execute SCT scripts, which are then likely executed by the system. The presence of a PE header in hex data and ClamAV detections for Win.Packer.MalwareCrypter-6642003-1 further confirm the malicious nature of the embedded content.

Heuristics 8

Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570

RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Win.Packer.MalwareCrypter-6642003-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Packer.MalwareCrypter-6642003-1
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 6 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://nsis.sf.net/NSIS_Error In RTF body

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003af9.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3AF9	874 bytes
SHA-256: `35408f311043edb8f275cde46dc36050aeca2c8eb6ccdc2715782c42fb4df849`
`objdata_01_off00004206.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4206	612 bytes
SHA-256: `c62851521e10316dfd43f2b6ee67cc27e2a24456bb346c8fa9dc4a6d6e21d526`
`objdata_02_off00004706.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4706	476 bytes
SHA-256: `576c3ae1c94d1d884002f0ab8439976dd6705c9e206c67a0e8a6f9b90007f346`
`objdata_03_off00004afa.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4AFA	836 bytes
SHA-256: `30159a190251b65f5805b9186cb004127d9b2fc25812d30704c028dddbc5f55b`
`objdata_04_off000051f3.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x51F3	2633 bytes
SHA-256: `1feb5f150bb35566d1a01fc59a357dc0ea34bc7498e0ec99bd939f6f848044b0`
`objdata_05_off000066d3.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x66D3	195945 bytes
SHA-256: `546deeff768fbfa920e97dc29aeb6b78a2d04ad9f21f1a075f622816b3e0f060`
Detection ClamAV: Win.Packer.MalwareCrypter-6642003-1 Obfuscation or payload: likely Carved artifact entropy is 7.88, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.