RTF malware analysis — malicious · 57b52e7659794398

MALICIOUS

RTF

546.4 KB Created: 2021-07-07 20:36:00

MD5: 0c6d5b9e963d1a6fb11938c6d7853775 SHA-1: b8874e8c3489471ea391614793e333f4a98bf9dc SHA-256: 57b52e76597943986be3be303ca5616f34f45504d868eefa7afab0c45a2c9de3

142 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects, with one specifically triggering activation via \objupdate. The critical heuristic firing for CVE-2017-8759 indicates exploitation of MSXML SAX OLE activation. This suggests the file is designed to execute arbitrary code by leveraging this vulnerability, likely to download and run a secondary payload.

Heuristics 5

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 8 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00005104.bin` `814bc8f4cd9426403fba24b410b2fe27b9d9123acb724d029bac83c703df6eac`	rtf-objdata-decoded	RTF \objdata at offset 0x5104	24123 bytes
`objdata_02_off00024aa2.bin` `3becde1337561c95a038acf4e78a356a28f802707a3035d3cc7269864192c6c7`	rtf-objdata-decoded	RTF \objdata at offset 0x24AA2	24123 bytes
`objdata_04_off00044440.bin` `3e18ed5646d7d676189626ce2d097bfb684f227e734d6b805cd16641d8b716cf`	rtf-objdata-decoded	RTF \objdata at offset 0x44440	24123 bytes
`objdata_06_off00063dde.bin` `3a15a681207660c51304365a11e732cd8dcac69cb71a620d8f3add08bdf2ecd8`	rtf-objdata-decoded	RTF \objdata at offset 0x63DDE	24123 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.