Malicious RTF — malware analysis report

Static analysis result for SHA-256 4372348fb2eaa1d8…

MALICIOUS

RTF

149.2 KB Created: 2017-11-23 01:06:00 First seen: 2018-12-09
MD5: 018039ee6a1cfab2a8354de5354d74f5 SHA-1: c77e15bd92b0222d6a993c8d33dfd16420ce8bc6 SHA-256: 4372348fb2eaa1d817f59770cab136d45a92bb769a90e7f0e55fd4a674f22ce2
240 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains multiple critical heuristic firings indicating exploitation of CVE-2017-8570 and CVE-2018-0802 via embedded OLE objects and the Equation Editor. These exploits are known to drop SCT scripts, which are then executed to further compromise the system. The presence of OLE object data and specific CLSIDs strongly suggests an exploit chain designed for arbitrary code execution.

Heuristics 5

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 8 \objdata section(s) — embedded OLE objects

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00009f05.bin rtf-objdata-decoded RTF \objdata at offset 0x9F05 708 bytes
SHA-256: 82edc7b35e16ccce14f6443086c66d416d06fff3e79aaa6aa0c3d208e9e59c49
objdata_01_off0000a6e5.bin rtf-objdata-decoded RTF \objdata at offset 0xA6E5 1360 bytes
SHA-256: fd94665b5b7750199d6ebd5a7c7167664ee660a77c118906da17f9d2ae2c6595
objdata_02_off0000b3dd.bin rtf-objdata-decoded RTF \objdata at offset 0xB3DD 935 bytes
SHA-256: 8db5a1cbedc8f26a10194ed6be2dcdf00bb762a2e327d2477b9dd78bfce6f3b3
objdata_03_off0000bdae.bin rtf-objdata-decoded RTF \objdata at offset 0xBDAE 3271 bytes
SHA-256: 3e4de491815c0ad3cf30a6f9cb6e81dfae7c19f1bc0f033dcb01ed50ca70124d
objdata_04_off0000dbfb.bin rtf-objdata-decoded RTF \objdata at offset 0xDBFB 2638 bytes
SHA-256: e78ffe5b7d886b8588e83f451594ffdcb97669a5949065bf9ec7c01e2d1039d1
objdata_05_off0000f345.bin rtf-objdata-decoded RTF \objdata at offset 0xF345 4682 bytes
SHA-256: c65ce061af8b5efd3937b0328541b772d7dfb61b1a6fbde25bb373663691b0c1
objdata_06_off00011a79.bin rtf-objdata-decoded RTF \objdata at offset 0x11A79 3980 bytes
SHA-256: 5332661473dbff66c1185cd33b8e7e65ede82eef2e0b723ffedb50dd36cfefbd
objdata_07_off00013c33.bin rtf-objdata-decoded RTF \objdata at offset 0x13C33 2601 bytes
SHA-256: 548a12a233463467fbc04f73681e9cda1f055346a94b39fdc964c8cf24643c6d

Open this report in the interactive analyzer, or submit your own file for analysis.