RTF malware analysis — malicious · 5ec78fc9faba272c

MALICIOUS

RTF

288.0 KB Created: 2018-07-13 12:19:00 First seen: 2021-02-23

MD5: 2858aec697d4d7b976e3214a17fce1e9 SHA-1: d4038e8a92c571fc80fd5503f7b3b6fb8b611202 SHA-256: 5ec78fc9faba272cf0a19c205231ce0a4ed9e5b225e24841e0afcbd6d764f050

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c43.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C43	24635 bytes
SHA-256: `b14569a22f0482ef4d612b05122a9fb3b9e400e0d448d2b2c5518e071be577c6`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off00015489.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x15489	24635 bytes
SHA-256: `e49eada362a08b42870252289c2c09aab8a056613c64f8d46951228af2f368c9`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026ccf.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CCF	24635 bytes
SHA-256: `d8f5d6d57cf08f0277d4d924666f7340a56b6060ad4dd370a6154ad0ec605437`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_03_off00038515.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x38515	24635 bytes
SHA-256: `dbd1aa6ffd0fdb40b0734c19f6310428a0136128db83852d1e025c38196c9db1`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.