RTF malware analysis — malicious · 7be2628f1cfba974

MALICIOUS

RTF

871.3 KB First seen: 2019-01-25

MD5: f7c8dd1979ca1405514d95c300831e8f SHA-1: 7bfc81662df718ecace5cbfc578ba6488daa4b1b SHA-256: 7be2628f1cfba974979208cace745561e0403c639df8e87238938c8afae30788

480 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple indicators of malicious OLE object embedding, specifically triggering heuristics related to CVE-2017-8570. This vulnerability is known to be used for dropping and executing arbitrary code, often a PE executable, as evidenced by the presence of RTF_MZ_HEX and extracted PE files. The ClamAV detection further confirms the malicious nature of the embedded content.

Heuristics 10

Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570

RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xml.Malware.Squiblydoo-6728833-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xml.Malware.Squiblydoo-6728833-0
PE header (with DOS stub) in hex data critical RTF_MZ_HEX

Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object — can wrap arbitrary files
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000451.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x451	442114 bytes
SHA-256: `6ae5cbe4b37feb02cc3810abdf8fb77d7d0c67d2e88e14f3ba490d0603e783da`
`objdata_01_off000d8294.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xD8294	712 bytes
SHA-256: `fbc0b8dd6649e26fbe715fc10e7a6985d8790c8e3d773e449bf858d363db4094`
Detection ClamAV: Xml.Malware.Squiblydoo-6728833-0 Obfuscation or payload: likely Static shellcode analysis recovered command string(s): WScript.Shell").Run("cmd /c %tmp%\\winsctrls.exe",0,false);
`objdata_02_off000d8873.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xD8873	2633 bytes
SHA-256: `bf4fdf61123c372b1c134aaa59cb59fa9f35f8a207ce20f257261d54c1d39d27`

Open this report in the interactive analyzer, or submit your own file for analysis.