Xls.Dropper.Agent-7085223-0 RTF malware analysis — malicious · 7356a7d4a201d91b

MALICIOUS

RTF

400.3 KB Created: 2019-04-22 22:38:00 First seen: 2019-08-04

MD5: 63ae92dbf515b6d2bc701ec59e55d82b SHA-1: ca88522759c38dc4bdc688efa9b840bf40e54384 SHA-256: 7356a7d4a201d91b8997bbd097d1257130df02b9140094270cb7119a152b8e61

242 Risk Score

Malware Insights

Xls.Dropper.Agent-7085223-0 · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects, with a critical heuristic indicating exploitation of CVE-2017-8759 for OLE activation. This suggests the file is designed to execute arbitrary code via the embedded objects. ClamAV detection as 'Xls.Dropper.Agent-7085223-0' further supports its malicious nature as a dropper. The embedded objects themselves are suspicious artifacts that likely contain the next stage of the attack.

Heuristics 7

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Doc.Dropper.Agent-6955827-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6955827-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002908.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2908	49710 bytes
SHA-256: `052a61b548e5ec64582c53f66795b6a86b2b41ff789f865f50df181cda7d0f72`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`objdata_01_off000208ab.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x208AB	49710 bytes
SHA-256: `b4b5e17389a16f049c669bfc35550e18be4f0b2de409f7000c6826fe5a1997ff`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`objdata_02_off0003e84e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3E84E	49710 bytes
SHA-256: `8aa3df2a0d5b439f38c9b4cca3c54c4805fe3b42249d19f337cfca2955328d04`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.