RTF malware analysis — malicious · 46c9fe1a39ef466c

MALICIOUS

RTF

762.9 KB Created: 2017-11-20 19:24:00 First seen: 2017-11-29

MD5: 15bebb359747a5c542589472d72a591d SHA-1: 85976973c81eb483ba308173f3af7602c9655dd5 SHA-256: 46c9fe1a39ef466cd71bdf4a058cc844b3d4d4e22c8cbeaa28e8eaa759c83519

442 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF document contains OLE object data that leverages CVE-2017-0199 or CVE-2017-8759 to load a remote payload from the URL http://kinesk.com/t/t.php?stats=send&thread=2. Heuristics indicate the presence of Metasploit shellcode and Windows API calls commonly used for execution and memory manipulation, suggesting the downloaded payload is likely malicious.

Heuristics 12

CVE-2017-0199 / CVE-2017-8759 (OLE2Link auto-activated remote loader) critical CVE related RTF_OLE2LINK_REMOTE_MONIKER_LOADER

RTF embeds an OLE2Link object that is force-activated with \objupdate (no user interaction on open) and fetches a remote second stage through an INCLUDETEXT/INCLUDEPICTURE field. This is the field-delivered OLE2Link auto-update attack path shared by CVE-2017-0199 (server returns an HTA/scriptlet) and CVE-2017-8759 (server returns a SOAP WSDL the .NET parser compiles). Office processes the fetched response through the same code path; the specific CVE depends on the now-unreachable server content type.
ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3

Metasploit reverse_tcp shellcode critical SC_MSF_REVERSE

Metasploit reverse_tcp shellcode

Disassembly

Attempted x86 opcode disassembly

0006D58B  fc                cld
0006D58C  e882000000        call 0x6d613
0006D591  5f                pop edi
0006D592  5e                pop esi
0006D593  5b                pop ebx
0006D594  8be5              mov esp, ebp
0006D596  5d                pop ebp
0006D597  c3                ret
0006D598  8d4000            lea eax, [eax]
0006D59B  53                push ebx
0006D59C  56                push esi
0006D59D  8bd8              mov ebx, eax
0006D59F  3b5324            cmp edx, dword ptr [ebx + 0x24]
0006D5A2  7436              je 0x6d5da
0006D5A4  8bf2              mov esi, edx
0006D5A6  85f6              test esi, esi
0006D5A8  7518              jne 0x6d5c2
0006D5AA  33c0              xor eax, eax
0006D5AC  8a4318            mov al, byte ptr [ebx + 0x18]
0006D5AF  8b04859cfe4600    mov eax, dword ptr [eax*4 + 0x46fe9c]
0006D5B6  50                push eax
0006D5B7  a190674700        mov eax, dword ptr [0x476790]
0006D5BC  8b00              mov eax, dword ptr [eax]
0006D5BE  ffd0              call eax
0006D5C0  8bd0              mov edx, eax
0006D5C2  895324            mov dword ptr [ebx + 0x24], edx
0006D5C5  c6434401          mov byte ptr [ebx + 0x44], 1
0006D5C9  8b4304            mov eax, dword ptr [ebx + 4]
0006D5CC  e8ba060000        call 0x6dc8b
0006D5D1  85f6              test esi, esi
0006D5D3  7505              jne 0x6d5da
0006D5D5  33c0              xor eax, eax
0006D5D7  894324            mov dword ptr [ebx + 0x24], eax
0006D5DA  5e                pop esi
0006D5DB  5b                pop ebx
0006D5DC  c3                ret
0006D5DD  8bc0              mov eax, eax
0006D5DF  3b5028            cmp edx, dword ptr [eax + 0x28]
0006D5E2  7413              je 0x6d5f7
0006D5E4  895028            mov dword ptr [eax + 0x28], edx
0006D5E7  c6402c00          mov byte ptr [eax + 0x2c], 0

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTE

RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// URL — Word can fetch the remote content on open depending on Office version and external-content settings, enabling remote template injection, NTLM capture via redirects, or payload delivery
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT

Reference to VirtualProtect API
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://kinesk.com/t/t.php?stats=send&thread=2 In RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000c568.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC568	2598 bytes
SHA-256: `831d653a8bf6b35f70c34b8f0aa9b4deff313b9e99f06c2a160f156cfbe686ed`
`objdata_01_off0000dc96.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDC96	2674 bytes
SHA-256: `b2d1dcd53ab72d489708eb5449a9c003c690279daf375b527c7e12791399d9fe`

Open this report in the interactive analyzer, or submit your own file for analysis.