Malicious RTF — malware analysis report

Static analysis result for SHA-256 56465df78454bc00…

MALICIOUS

RTF

50.3 KB Created: 2017-04-26 22:56:00 First seen: 2017-10-10
MD5: 362751f12576af643df0d6ea539b9be5 SHA-1: 62b711dcbc511296cd0fbe9b52218ccdea53181c SHA-256: 56465df78454bc009fbaccf708dd3867264b77b6fbb1f500161e53646c167b7f
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and is flagged for CVE-2017-8759, indicating exploitation of a SOAP Moniker vulnerability. This technique is commonly used to download and execute arbitrary code. The presence of an automatically linked OLE object further supports this attack vector. ClamAV also identifies the file as a downloader.

Heuristics 5

  • SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) critical CVE related CVE_2017_8759
    RTF \objdata decodes to OLE data containing the SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003326.bin rtf-objdata-decoded RTF \objdata at offset 0x3326 2766 bytes
SHA-256: 7f3fb0ef23d37f97a0859661bfecdb4af94f61f4c87bc3df1c27eb0f90741014

Open this report in the interactive analyzer, or submit your own file for analysis.