Malicious RTF — malware analysis report

Static analysis result for SHA-256 57c4a027a910556c…

MALICIOUS

RTF

1.16 MB First seen: 2019-03-10
MD5: 93f208b4cbb8635541f7802e9a40ec10 SHA-1: ea91acdaef537cc3da8b5030ed78bb29ac80e1ef SHA-256: 57c4a027a910556c6b9d30a9249510cb944d28a2b39098eac8221069281bed2d
342 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1027 Obfuscated Files or Information

The RTF file contains multiple indicators of malicious activity, including OLE object data, composite monikers, and excessive hex data, strongly suggesting it is a dropper. Specifically, the CVE-2017-8570 heuristic indicates the file is designed to drop a SCT script, and the presence of PE header data in hex further confirms the embedding of an executable payload. The embedded URLs are likely used for command and control or to download additional stages.

Heuristics 9

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1212KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 6 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.alsraiyesgroup.com/ In RTF body
    • http://www.alsraiyesgroup.comIn RTF body
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn RTF body

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0001a406.bin rtf-objdata-decoded RTF \objdata at offset 0x1A406 885 bytes
SHA-256: 7d5f88680e60b61c3804b4e958745d940ae073cb6f167cc9e0d1a27e8996ab45
objdata_01_off0001ab23.bin rtf-objdata-decoded RTF \objdata at offset 0x1AB23 23244 bytes
SHA-256: 415ea7c65e24c46fa0be8634fb0b29328537d4416a29f248bc0d8b4c04431cb7
objdata_02_off000260ed.bin rtf-objdata-decoded RTF \objdata at offset 0x260ED 464 bytes
SHA-256: e703848bebd5a70ed3890f101964afa809d470068426f899f139fe667cfa40f0
objdata_03_off000264c1.bin rtf-objdata-decoded RTF \objdata at offset 0x264C1 820 bytes
SHA-256: d6e0de80a1802cce16fd208d08beb938c29c6d62984b89d9b3f972281ec4f244
objdata_04_off00026b90.bin rtf-objdata-decoded RTF \objdata at offset 0x26B90 2633 bytes
SHA-256: fe11c27d916ab897eb94064e9631d8a29c847a6db39259bef31578da8d19fdf5
objdata_05_off0002806a.bin rtf-objdata-decoded RTF \objdata at offset 0x2806A 524492 bytes
SHA-256: 9cd52a24a7a47f32fd98eb8702e6e0fe9532117f87b19800ec731ec385210e77
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_GETPC_CALL, SC_PEB_ACCESS Static shellcode analysis recovered API/import strings: LoadLibraryA, GetProcAddress, VirtualAlloc, CreateFileA, OpenProcess

Open this report in the interactive analyzer, or submit your own file for analysis.