Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 6d2e5346cef935c9…

MALICIOUS

RTF / .DOC

227.7 KB
MD5: f348d80bbd6fa77fbdeb94ee1e0143c9 SHA-1: 9dce167d02e0fa4b06f263b4dc2964a0cbcc99ab SHA-256: 6d2e5346cef935c936e81cc416e6bcb52cd0332410082933a30dc1a9f6d125a5
240 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF document contains multiple indicators of malicious OLE object embedding, including Composite Moniker and ".objupdate" directives, which are known to be exploited by CVE-2017-8570 to drop and execute script files. The document body explicitly instructs the user to 'Enable Editing', a common lure to bypass macro security and activate the embedded malicious content.

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000965.bin
2675f5b0341da006f53a22f67cf4d977a631854f110b7a8c21b6337ff7ba18f2
rtf-objdata-decoded RTF \objdata at offset 0x965 19844 bytes
objdata_01_off0000ab42.bin
18cff8ef194415d33763880bf64011d23305e4b9143b76244b89e1c53b70a0d5
rtf-objdata-decoded RTF \objdata at offset 0xAB42 2632 bytes
objdata_02_off0000c0e5.bin
44deae4627fee3c44f54d5bd10477ec2e17f4c08135f08e2417832e36d10d037
rtf-objdata-decoded RTF \objdata at offset 0xC0E5 12297 bytes