Malicious RTF — malware analysis report

Static analysis result for SHA-256 79fde274095b7243…

MALICIOUS

RTF

603.4 KB First seen: 2018-06-19
MD5: 88ddc99c61d782a73a38fd6d38d4841e SHA-1: 71e134bfc4e68463a33b008918869fd87cb0f33f SHA-256: 79fde274095b7243fce78dd6b65ae8024661dfa096490db492c8e26906695843
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE objects and triggers CVE-2017-8570, which is known to drop SCT scripts. The INCLUDETEXT/INCLUDEPICTURE heuristic points to a remote URL, suggesting the file is designed to download and execute a secondary payload. The extracted artifacts 'objdata_02_off00026b15.bin' and 'objdata_04_off0009529b.bin' are flagged as potential shellcode candidates.

Heuristics 8

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTE
    RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// URL — Word can fetch the remote content on open depending on Office version and external-content settings, enabling remote template injection, NTLM capture via redirects, or payload delivery
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • OLE object data medium RTF_OBJDATA
    RTF contains 6 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cms-gov.com/doc/t.php?thread=0&stats=send In RTF body
    • https://secure.comodo.net/CPS0CIn RTF body
    • http://ocsp.comodoca.com0In RTF body
    • https://www.globalsign.com/repository/03In RTF body
    • http://crl.globalsign.net/root.crl0In RTF body
    • https://www.globalsign.com/repository/0In RTF body
    • http://crl.globalsign.com/gs/gstimestampingg2.crl0TIn RTF body
    • http://secure.globalsign.com/cacert/gstimestampingg2.crt0In RTF body
    • http://crl.comodoca.com/COMODORSACodeSigningCA.crl0tIn RTF body
    • http://crt.comodoca.com/COMODORSACodeSigningCA.crt0$In RTF body
    • http://crl.comodoca.com/COMODORSACertificationAuthority.crl0qIn RTF body
    • http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$In RTF body

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000030.bin rtf-objdata-decoded RTF \objdata at offset 0x30 43352 bytes
SHA-256: 3317e90b54c9c2172989992bc1e0a7c970e1935fdfdcd7752da3c94dbfeef69f
objdata_01_off00026847.bin rtf-objdata-decoded RTF \objdata at offset 0x26847 331 bytes
SHA-256: b4a983960ffa3c0f44b24d291ce25aafcfd5a9b8e76555d8bcdabccfd469ee33
objdata_02_off00026b15.bin rtf-objdata-decoded RTF \objdata at offset 0x26B15 223770 bytes
SHA-256: 4c0aabd3867d6d6e451239b96b09be2815e1d187c3c64ff1ae00a01a2a241457
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: NOP sled
objdata_03_off00093f81.bin rtf-objdata-decoded RTF \objdata at offset 0x93F81 2417 bytes
SHA-256: fa388763913a4a08c9679c205158bd501c7a427933f11f624e51547f1f3181a9
objdata_04_off0009529b.bin rtf-objdata-decoded RTF \objdata at offset 0x9529B 718 bytes
SHA-256: ee3767dfb57e3c45452d51fff662e3cc9d4f9791085989f8cfbaf944e3947c84
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Shell")
objdata_05_off00095879.bin rtf-objdata-decoded RTF \objdata at offset 0x95879 2633 bytes
SHA-256: 1b11531569c98284e74e6ae4c14275a0ab013edb5d6151ea140c1c38c40ac41e

Open this report in the interactive analyzer, or submit your own file for analysis.