Malicious RTF — malware analysis report

Static analysis result for SHA-256 741bd93edfa957be…

MALICIOUS

RTF

6.63 MB Created: 2014-11-14 09:46:00 First seen: 2015-04-15
MD5: aed967aa0814092af38187b19dc56f71 SHA-1: fd5839ba1b13191a60eaaa903a3dc3b6673578b6 SHA-256: 741bd93edfa957be3b6517e93c2fd613028fb0e6b778b35c6c9da6b7a44f1e72
122 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and exhibits characteristics of the CVE-2012-0158 vulnerability, indicating exploitation for client execution. The presence of excessive hex data within the OLE object suggests a hidden payload, and a suspicious executable is referenced via an unknown reputation URL. This points to a spearphishing attachment designed to exploit a known vulnerability and download a secondary payload.

Heuristics 5

  • MSCOMCTL.ListView — CVE-2012-0158 high CVE related CVE_2012_0158
    RTF \objdata decodes to OLE data containing the MSCOMCTL.ListView — CVE-2012-0158 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~6497KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hannahbeaver.rocks/wp-content/doublexx.exe In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0063f84a.bin rtf-objdata-decoded RTF \objdata at offset 0x63F84A 440 bytes
SHA-256: ea5d234f81e7c6f4d2681a1e14ba35656c4caea1ff0358220f369a5f5b5ba6da
objdata_01_off00648060.bin rtf-objdata-decoded RTF \objdata at offset 0x648060 4868 bytes
SHA-256: 5299d5260c748d61cd0961879946694e17e4fa8f13800e07a5356c62d7cc18fe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS
objdata_02_off00650a25.bin rtf-objdata-decoded RTF \objdata at offset 0x650A25 2353 bytes
SHA-256: efc67427605ac702178de53f9d9379d7180885a26f5530c4c9d82f7b5b808e39

Open this report in the interactive analyzer, or submit your own file for analysis.