Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 7872305aab420a75…

MALICIOUS

RTF / .DOC

2.07 MB Created: 2012-12-15 15:03:00 Authoring application: LibreOffice/7.1.2.2$Linux_X86_64 LibreOffice_project/8a45595d069ef5570103caea1b71cc9d82b2aae4
MD5: 144b195bfa3deea54e133c06eb308816 SHA-1: 0d3eeacd8a1a76fbc98a4d4cfc7d1436cc58a75d SHA-256: 7872305aab420a758b74bad9b7aa6d81fdc40cf3f5b744edcdc643da94296a2b
260 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF document contains multiple indicators of malicious activity, including the presence of OLE objects and a critical firing for CVE-2017-8570, which is known to drop SCT scripts. The document body appears to be a proforma invoice, likely a lure. The exploitation of CVE-2017-8570 suggests the file's primary purpose is to execute a secondary payload, likely a script.

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1822KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off001c8e87.bin
919751910456273faec7a81e0ed696e9fc722299ac80988f748281955b44d07b		 rtf-objdata-decoded RTF \objdata at offset 0x1C8E87 38988 bytes
objdata_01_off001cf636.bin
b4914d675bdcc4891272f2bf4945b461568f33c8003aa6895aa9fa8bec645cfb		 rtf-objdata-decoded RTF \objdata at offset 0x1CF636 38961 bytes
objdata_02_off001e3365.bin
3cd3b7d42e5855c90d6d11c54ef2670ed8970441480cc23f7d39ef08fa1c935b		 rtf-objdata-decoded RTF \objdata at offset 0x1E3365 2632 bytes
objdata_03_off001e4908.bin
e8d4fe950caed6dcfde26f4b616825bbe11b93458425974b7d075167f675abf7		 rtf-objdata-decoded RTF \objdata at offset 0x1E4908 12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.