RTF malware analysis — malicious · 403c24866f73203a

MALICIOUS

RTF

448.0 KB Created: 2018-07-13 13:03:00 First seen: 2021-02-23

MD5: b772360c894f6f9a74e2f608d6b1e1a9 SHA-1: 65b0327f70aa98293203fa4c551084b90920a7e9 SHA-256: 403c24866f73203ad4edea6e887b3d9ab046f26be9baa9dbcef4e7d31a69430a

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 7 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c41.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C41	24635 bytes
SHA-256: `dd29be6fc34e9599ad54e9834e5b91863bac57b6869a4d9796c31a4cad1bb0ea`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off00015487.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x15487	24635 bytes
SHA-256: `fdcc8ff3cd654e7bb9a3480551cdd71d9f6b3448be5710cfb30e073971a7232f`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026ccd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CCD	24635 bytes
SHA-256: `5fea705d0adf8234636c9e4f8571601979a94020778362fe9d30e990a84f5930`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_03_off00038513.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x38513	24635 bytes
SHA-256: `05793135a3f6da4b1c56527a010385b18c922eaa7b9a546326df8971deee2bed`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_04_off00049d59.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x49D59	24635 bytes
SHA-256: `09d20eaae1775c4a32cb22083f1d951e078c135b33170765ae1587a7c45b9d60`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_05_off0005c3bb.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5C3BB	24635 bytes
SHA-256: `e04a0e67943740b714b8eb2030c3861282efb29211f2baef3a60ac2c0ef8562c`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_06_off0006dc20.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x6DC20	4554 bytes
SHA-256: `17710973647746841a94c57f6049074124f86f698c042ffe57201cad4a538d7b`

Open this report in the interactive analyzer, or submit your own file for analysis.