Malicious RTF — malware analysis report

Static analysis result for SHA-256 7a5e24d994acb0d8…

MALICIOUS

RTF

921.3 KB Created: 2018-03-12 22:19:00 First seen: 2018-06-25
MD5: 086eb0a99de97fa52601f06bfab5c01c SHA-1: 8033081d9325d8d5e42afb5fd2f220ba9295ecf9 SHA-256: 7a5e24d994acb0d8a4c9fa589af8d236e6cf772666fc6b8e44f194d9faf53827
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an ".objupdate" command, which is indicative of exploiting vulnerabilities like CVE-2017-8759 for client execution. ClamAV detections further confirm its malicious nature, flagging it as Doc.Macro.Obfuscation. The primary attack vector is likely spearphishing attachment, with the embedded OLE object serving as the mechanism to download and execute a secondary payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 11 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c4d.bin rtf-objdata-decoded RTF \objdata at offset 0x2C4D 28731 bytes
SHA-256: 6be4f3bd756bb3d801792b8d3154f60262f5639ca19dea91c0e0cdb604b4958e
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_01_off00016c8e.bin rtf-objdata-decoded RTF \objdata at offset 0x16C8E 28731 bytes
SHA-256: ad6710cebcd5bd5a78b3c695ce1c8da9cf33bd0864efec44b86aa707b55ba5ce
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_02_off0002accf.bin rtf-objdata-decoded RTF \objdata at offset 0x2ACCF 28731 bytes
SHA-256: 8bfc9abf80a82b82e74f56adf9646c2d9820e14605fde6ec2d09da97add30fc6
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_04_off00052d51.bin rtf-objdata-decoded RTF \objdata at offset 0x52D51 28731 bytes
SHA-256: f31bb65f1d43fd7ff6f8fdbfd6d5c4f8475df359cd9c1119e15bcac0a70d07d9
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_06_off0007add3.bin rtf-objdata-decoded RTF \objdata at offset 0x7ADD3 28731 bytes
SHA-256: a7657cf2f924a9b20b73dd64a8c34ea3a1a69dec3f7ecd006f20e5d55f8033a0
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_07_off0008ee14.bin rtf-objdata-decoded RTF \objdata at offset 0x8EE14 28731 bytes
SHA-256: 825e604a611d523c21ffe89d7a207b2cbfba3f84505c394150b5feb5853a74a5
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_09_off000b6e96.bin rtf-objdata-decoded RTF \objdata at offset 0xB6E96 28731 bytes
SHA-256: 1fe554656afad3ba47a5bf17ca80aa76e1202175eeca84b590e2262f311b0803
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_10_off000caed7.bin rtf-objdata-decoded RTF \objdata at offset 0xCAED7 28731 bytes
SHA-256: 9f3e7da358786a0d784159091042053d496868ac53a0dc771c560d541f77df09
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.