Malicious RTF — malware analysis report

Static analysis result for SHA-256 7c685dc3cd249a6c…

MALICIOUS

RTF

493.4 KB First seen: 2019-05-31
MD5: e96532fe5bf2919b68894502545268cc SHA-1: 076cdedca1c682922975f4bc374708e91a230686 SHA-256: 7c685dc3cd249a6ccde6796d6591d31a933d5504c6dc4d5670a0b83077aaa9a4
82 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data, triggering heuristics for CVE-2012-1856 (MSCOMCTL.Toolbar). This indicates the file is designed to exploit this vulnerability for client-side execution. The embedded object, objdata_00_off00000a54.bin, is a likely payload. The benign URLs extracted are not indicative of malicious activity.

Heuristics 4

  • MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856 high CVE related CVE_2012_1856
    RTF \objdata decodes to OLE data containing the MSCOMCTL.Toolbar — CVE-2012-0158 / CVE-2012-1856 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In RTF body
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn RTF body
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000a54.bin rtf-objdata-decoded RTF \objdata at offset 0xA54 8546 bytes
SHA-256: 5278a9e4af092ff06f6674aaf33ef3d3ae839e70a385d2d3338e5c314b5dd723
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: NOP sled

Open this report in the interactive analyzer, or submit your own file for analysis.