RTF malware analysis — malicious · 3a3bc31afcf2ec82

MALICIOUS

RTF

6.01 MB Created: 2018-04-09 06:38:00 First seen: 2020-02-04

MD5: a907cb142ff5b2b789b7cb3bd5a307bc SHA-1: a5ac2ed6eaf37de11803e333cd19a4e20c0a0d38 SHA-256: 3a3bc31afcf2ec82ff9ac0016ce47e10833227665ab056117520bdf097525c63

422 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple OLE objects, including a package object, and uses \objupdate to force activation. Critical heuristics indicate exploitation of CVE-2017-8759, a known vulnerability in MSXML SAX, which is likely used to execute a payload. ClamAV detections confirm the malicious nature, identifying it as Xml.Malware.Squiblydoo-6728833-0.

Heuristics 10

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Xml.Malware.Squiblydoo-6728833-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xml.Malware.Squiblydoo-6728833-0
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~4399KB of hex-encoded data inside \objdata sections — may hide a payload
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002b26.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2B26	2182409 bytes
SHA-256: `ab14c79917a9d1fef29226e11ba27f17317feb39f509f3b26c288b86227e21dc`
`objdata_01_off0043c257.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x43C257	120102 bytes
SHA-256: `93b73aff1a85fed9a3f0dd86e0111dbf75136e9c8de8fd989f7d138293127cd3`
`objdata_02_off0047e9e4.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x47E9E4	793 bytes
SHA-256: `e69c744472741e99a4bf0675836e6ca593c0e79c8ed6f0acbc559f39e2343246`
Detection ClamAV: Xml.Malware.Squiblydoo-6728833-0 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): WScript.Shell").Run("wscript.exe /nologo %temp%/fonts.vbs");
`objdata_03_off005f547c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5F547C	3488 bytes
SHA-256: `6fe0f1f2cab605ef805ec4124da16f8d9b5a894251f2e84d2321e8972cfe97a4`

Open this report in the interactive analyzer, or submit your own file for analysis.