RTF malware analysis — malicious · 4d25a66570135422

MALICIOUS

RTF

1.06 MB Created: 2018-03-31 16:59:00 First seen: 2018-04-23

MD5: cadf03649a459b5f8fef51ab05ed43f5 SHA-1: 0b336d074cdea06e087399eb7e5907a1c2e612e6 SHA-256: 4d25a66570135422826b58278654157c7ab78bfbf771f4688ffb87ad558764af

302 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects with excessive hex-encoded data, and the ".objupdate" directive forces OLE activation. Crucially, the heuristic firing for CVE-2017-8759 indicates exploitation of this vulnerability via MSXML SAX OLE activation. This suggests the file is designed to execute arbitrary code by leveraging this known vulnerability, likely as a downloader for further malicious activity.

Heuristics 7

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1000KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 12 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 12

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002c20.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2C20	27707 bytes
SHA-256: `7b2c7e1c36dd3dc216115692739697600fa7604c85106138db971e5f63a09523`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_01_off000107ef.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x107EF	27707 bytes
SHA-256: `e662f10c9cffe18909d265e9e9d79fb68278e30954dfb4528e4037de8483038f`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_02_off00023af6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x23AF6	27707 bytes
SHA-256: `51978377f99c78f62e4f957f8c4a7a3e7de54d1e19f50638ddecba8757cb1d35`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_03_off00036dff.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x36DFF	27707 bytes
SHA-256: `4d47d6d4feafaa9d4553166f0dc4a4962e55b9a89ea46cc52c711a3bed538e97`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_04_off00051e1a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x51E1A	27707 bytes
SHA-256: `5cdca1da64dc8089a7df4ffc433f4fecb75512aa68891ce826fdc6e0021e358e`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_05_off00065123.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x65123	27707 bytes
SHA-256: `7e08a408f08d4e22d0e988bc94e1a616b1207c58b87a7e77483be92fcc52963b`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_06_off0007842c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x7842C	27707 bytes
SHA-256: `4e5cd133a21b48035ce60549943002c39ba6f1e05e2628c4519b9c14e66fbd80`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_07_off00098c80.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x98C80	27707 bytes
SHA-256: `1356801f712a2c32d2f7a594f1a025875cf338d0f71c99eb3cb32016606b40d5`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_08_off000abf89.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xABF89	27707 bytes
SHA-256: `09ab6bdb62b9412875991e470158e2a332e074d34b353eaf5ccc1dd394d499a2`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_09_off000c7a38.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC7A38	27707 bytes
SHA-256: `4aed72a165983df182ebda9b909de228d7e211cce8b877ac8e4278386d5bc554`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_10_off000dad41.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDAD41	27707 bytes
SHA-256: `47105764f5607c0458a91a3689139c5ea8d0115a77281918f9dc2ed845bbf7d3`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely
`objdata_11_off000ee04a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xEE04A	27707 bytes
SHA-256: `2d07a60144d9809b5cd933ab0400d8a7ef1abadb98e6d62fbfc1f50e97056324`
Detection ClamAV: Doc.Macro.Obfuscation-6391394-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.