Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 3ab009d5a0d13bbf…

MALICIOUS

RTF / .DOC

216.3 KB First seen: 2022-09-22
MD5: 128d7460bee789e11e38155f58089e66 SHA-1: 2b1634891c18d4d12e510c58a82e4316f49720c6 SHA-256: 3ab009d5a0d13bbfb39773b6f0c4c6f1e42a34c40cb89aa52c70966caf4b778a
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1559.002 Component Object Model Hijacking

The RTF document contains embedded OLE objects with composite monikers, triggering heuristics related to CVE-2017-8570. This vulnerability is known to be used to drop and execute script files, such as SCT files, which likely leads to further stages of the attack. The presence of multiple objdata sections and objupdate directives further indicate malicious intent to activate embedded content.

Heuristics 5

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000007d5.bin
ce5e43edc0587d48c3d05b8e066f7c54b256f4d9cd3c9052cb34ba3643536cd8		 rtf-objdata-decoded RTF \objdata at offset 0x7D5 15089 bytes
objdata_01_off0000830b.bin
a972f385591d50d8ef9b0e90b730f6ae627bd35d8f72dc0fb5aa0b59c4a71d1a		 rtf-objdata-decoded RTF \objdata at offset 0x830B 2632 bytes
objdata_02_off000098ae.bin
142dc43284d9abe994719f8fb67bc4c04bfc3f07528a1a66b0bad7e552ee8e78		 rtf-objdata-decoded RTF \objdata at offset 0x98AE 12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.