Malicious RTF — malware analysis report

Static analysis result for SHA-256 66ffdf64b7b06bbd…

MALICIOUS

RTF

198.0 KB Created: 2018-06-07 13:10:00 First seen: 2021-02-23
MD5: c81e28ee2a38a65f0817abe5ce4296f1 SHA-1: 0059afe71d034d9d4c906b8dd06b1c4e22c936cc SHA-256: 66ffdf64b7b06bbdc3a560e6024eeda9b2c341716e373a1229a0d202dbd9e5ed
242 Risk Score

Heuristics 6

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003d12.bin rtf-objdata-decoded RTF \objdata at offset 0x3D12 32827 bytes
SHA-256: 4e3aace49cb0be55f99a7a35b6b756d5c6882b86e2c7ec357aaf1e32c0f1386c
Detection
ClamAV: Xls.Malware.Sload-7135989-0
Obfuscation or payload: unlikely
objdata_01_off000195f7.bin rtf-objdata-decoded RTF \objdata at offset 0x195F7 32827 bytes
SHA-256: 15e4a3074dbc3f1a19cbaed4ee5ac428a4f5a5f68c39d0ae912a85193fb6f301
Detection
ClamAV: Xls.Malware.Sload-7135989-0
Obfuscation or payload: unlikely
objdata_02_off0002eedc.bin rtf-objdata-decoded RTF \objdata at offset 0x2EEDC 5235 bytes
SHA-256: 8532352748c7bb6b27b96d33a231c92b68fae7ab96ea0563dc336591506f9f8b

Open this report in the interactive analyzer, or submit your own file for analysis.