RTF malware analysis — malicious · 85ea5b37f13e3398

MALICIOUS

RTF

311.9 KB First seen: 2019-05-31

MD5: b8cc2b993d22b40144191849332a4ad6 SHA-1: 0c37c56b7967b5b29ab048c3b6297834ffd030f7 SHA-256: 85ea5b37f13e3398b1d483992ccdf8cd329d720be5b469c2370a391db23baec3

80 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that triggers the CVE-2012-0158 vulnerability, which is known to be exploitable for client execution. The heuristic firings indicate the presence of shellcode within the decoded OLE object data, suggesting it is designed to execute a payload.

Heuristics 3

MSCOMCTL.ListView — CVE-2012-0158 high CVE related CVE_2012_0158

RTF \objdata decodes to OLE data containing the MSCOMCTL.ListView — CVE-2012-0158 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000030b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x30B	52768 bytes
SHA-256: `2c9979953dac498c22e945dcd2d909451ea3cfe427b811f2b664f907fb81c79a`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS

Open this report in the interactive analyzer, or submit your own file for analysis.