RTF malware analysis — malicious · 7008cf3a42801049

MALICIOUS

RTF

336.0 KB Created: 2018-07-13 13:03:00 First seen: 2021-02-23

MD5: 520303fbe4b35814e8aa3ae6b1a5b10a SHA-1: 4fae360b077a97ac247c67dec290f39c6a7994eb SHA-256: 7008cf3a4280104960bc84e6bfadad4a82129b03335cd1158dbe396efe87046a

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c41.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C41	24635 bytes
SHA-256: `dd29be6fc34e9599ad54e9834e5b91863bac57b6869a4d9796c31a4cad1bb0ea`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off00015487.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x15487	24635 bytes
SHA-256: `fdcc8ff3cd654e7bb9a3480551cdd71d9f6b3448be5710cfb30e073971a7232f`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026ccd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CCD	24635 bytes
SHA-256: `5fea705d0adf8234636c9e4f8571601979a94020778362fe9d30e990a84f5930`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_03_off00038513.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x38513	24635 bytes
SHA-256: `05793135a3f6da4b1c56527a010385b18c922eaa7b9a546326df8971deee2bed`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_04_off00049d59.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x49D59	20654 bytes
SHA-256: `27b61817c9676c3b6ae74ba96e6b1ef8b9105d56e73a20dc548ee48830bef799`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.