Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 6f15070d9d3c0bc0…

MALICIOUS

RTF / .DOC

216.3 KB First seen: 2022-09-22
MD5: 6caa64e76f4c59ea0f92960bd0514838 SHA-1: e091d91c2ab5685265c480edc392b2e892e4d33e SHA-256: 6f15070d9d3c0bc0257da93111a27cf21d0e2fcc50f19fc76f255dafca520773
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1559.002 Component Object Model Hijacking

The RTF document contains embedded OLE objects with composite monikers, which are indicative of exploitation for CVE-2017-8570. This vulnerability allows for the dropping and execution of script files, likely to download and run a secondary payload. The presence of multiple objdata sections and specific composite moniker-related heuristics strongly suggests this attack vector.

Heuristics 5

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000007d5.bin
bd9f9b1df9aed6abfa3c741f68356eeb0007dd6a06a3fa40a28ea04a7b8a6976		 rtf-objdata-decoded RTF \objdata at offset 0x7D5 15089 bytes
objdata_01_off0000830b.bin
a972f385591d50d8ef9b0e90b730f6ae627bd35d8f72dc0fb5aa0b59c4a71d1a		 rtf-objdata-decoded RTF \objdata at offset 0x830B 2632 bytes
objdata_02_off000098ae.bin
142dc43284d9abe994719f8fb67bc4c04bfc3f07528a1a66b0bad7e552ee8e78		 rtf-objdata-decoded RTF \objdata at offset 0x98AE 12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.