Malicious RTF — malware analysis report

Static analysis result for SHA-256 6b31df0267a76378…

MALICIOUS

RTF

737.1 KB Created: 2018-05-02 20:09:00 First seen: 2019-02-26
MD5: b9c8e7bd8c50dd78643d85a4808559b3 SHA-1: 40fcea0ea23407b3601f3e52b750be11b2b7463f SHA-256: 6b31df0267a76378f70153b104354ac0829ea39712d26d62b149c614ac4e43e9
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an ".objupdate" command, which is indicative of exploiting vulnerabilities like CVE-2017-8759 for client execution. ClamAV detections further confirm its malicious nature, flagging it as Doc.Macro.Obfuscation. The primary attack vector is likely spearphishing attachment, with the embedded OLE object serving as the mechanism to download and execute a secondary payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c14.bin rtf-objdata-decoded RTF \objdata at offset 0x2C14 24123 bytes
SHA-256: 46df04467044455e11a38e2b7abbc7f1e4d299d668f4833d829ee065c403ccdc
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_01_off0001429a.bin rtf-objdata-decoded RTF \objdata at offset 0x1429A 24123 bytes
SHA-256: d0ef7874711a1a5c3f4577ddd7006f9634af719f8fd651761048958ecaa49658
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_02_off00025920.bin rtf-objdata-decoded RTF \objdata at offset 0x25920 24123 bytes
SHA-256: 551b6202f2823f4935270298dabf9d04e292eee709a779a7c5ad004df53f9b92
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_03_off00036fa6.bin rtf-objdata-decoded RTF \objdata at offset 0x36FA6 24123 bytes
SHA-256: 3472e162a59f74d043081768b2234fed2096fd102fa71afc034dc50817761a9a
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_04_off0004862c.bin rtf-objdata-decoded RTF \objdata at offset 0x4862C 24123 bytes
SHA-256: f96453fd30d0b25c971c85e1ee966979dc532396426d951efa0f25e5b63564f0
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_05_off00059cfc.bin rtf-objdata-decoded RTF \objdata at offset 0x59CFC 24123 bytes
SHA-256: 02a693af23189568eae5cc73bd59afa0a3dd9c9ddb6c60ba784210a80597c57b
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_06_off0006b382.bin rtf-objdata-decoded RTF \objdata at offset 0x6B382 24123 bytes
SHA-256: 5aaea291af8b602b1c47d487fe4afafe50d0dd6d24cf80ed4de4f77ccc5f981d
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_07_off0007ca08.bin rtf-objdata-decoded RTF \objdata at offset 0x7CA08 24123 bytes
SHA-256: 7b85025e88ad513a3ad3e290315a2d407a5316a524d22a81627dc12807e8ccdd
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_08_off0008e08e.bin rtf-objdata-decoded RTF \objdata at offset 0x8E08E 24123 bytes
SHA-256: 4e3b3222b77700fea1cdefc0b209fcca4be4430ca76336303237ec6ae3a109b0
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely
objdata_09_off0009f714.bin rtf-objdata-decoded RTF \objdata at offset 0x9F714 24123 bytes
SHA-256: 6654f2e9a2ee0a19c7d335cf7316498decbc326c5f2901ce28a451fc75c5a382
Detection
ClamAV: Doc.Dropper.Agent-6412232-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.