Malicious RTF — malware analysis report

Static analysis result for SHA-256 5b0c53fda2a11018…

MALICIOUS

RTF

91.9 KB Authoring application: Msftedit 5.41.21.2510 First seen: 2015-09-18
MD5: 5dc128b70e4f08883484d2875808e8c0 SHA-1: be149759d0892aeaa9847a488407f4448b4f8c7a SHA-256: 5b0c53fda2a11018e98dc44da64eba7f3720b25d9da95999df0ba9f56984d3f6
120 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains embedded OLE objects, specifically triggering the CVE-2012-0158 vulnerability related to MSCOMCTL.ListView. This indicates an attempt to exploit a known client-side vulnerability for code execution. The presence of RTF_OBJDATA and RTF_OBJCLASS_PACKAGE heuristics further supports the exploitation of embedded objects.

Heuristics 4

  • MSCOMCTL.ListView — CVE-2012-0158 high CVE related CVE_2012_0158
    RTF \objdata decodes to OLE data containing the MSCOMCTL.ListView — CVE-2012-0158 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Package object class high RTF_OBJCLASS_PACKAGE
    OLE Package object — can wrap arbitrary files
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000a8.bin rtf-objdata-decoded RTF \objdata at offset 0xA8 40015 bytes
SHA-256: 36ab00c93e5cc9cd155d14a24c70478cfec6063711a923355f2a6012442906ef
objdata_01_off00014a10.bin rtf-objdata-decoded RTF \objdata at offset 0x14A10 4502 bytes
SHA-256: 76c57a11bc2b321fcfad293dff7dbd881be2786d0159290e48ba17f46486d9dc
objdata_02_off00014b73.bin rtf-objdata-decoded RTF \objdata at offset 0x14B73 4371 bytes
SHA-256: 163577a7d1c90f0c9bcb5630143703f4b062dc8719f51a8a0b2cacfef0708744

Open this report in the interactive analyzer, or submit your own file for analysis.