Xls.Malware.Sload-7135989-0 — RTF malware analysis

Static analysis result for SHA-256 87eb7cd984e1c93f…

MALICIOUS

RTF

821.6 KB Created: 2018-04-09 06:39:00 First seen: 2018-04-23
MD5: 7eb835c54555e15b81e6d40c773ed29e SHA-1: b20ff3661deeb0c4c9103a2d6adef43ee43707db SHA-256: 87eb7cd984e1c93fd3fb57cc7192f4ff68ec49275f024767d027425cb7c0fb5a
242 Risk Score

Malware Insights

Xls.Malware.Sload-7135989-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple OLE objects, with heuristics indicating ".objupdate" forces OLE activation and the presence of Composite Monikers. ClamAV signatures identify the embedded content as Xls.Malware.Sload-7135989-0, suggesting an exploit targeting spreadsheet functionality. The primary attack vector is likely spearphishing, with the embedded OLE object serving as the malicious payload.

Heuristics 6

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Doc.Macro.Obfuscation-6391394-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6391394-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000291a.bin rtf-objdata-decoded RTF \objdata at offset 0x291A 29243 bytes
SHA-256: c20bbf92748e9509361b2dc8acab7d7da95c0701858c1303c8b2d14a39f7e987
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_01_off00016546.bin rtf-objdata-decoded RTF \objdata at offset 0x16546 29243 bytes
SHA-256: 0b3c731eecff74530095b79c934eedbfd703c009efc6952cf83f781db56cbe10
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_02_off0002a1ee.bin rtf-objdata-decoded RTF \objdata at offset 0x2A1EE 29243 bytes
SHA-256: 201b86cf847c048e770934d240fb7c6579e5f838602e57f4b74eca9826f7cecb
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_03_off0003de98.bin rtf-objdata-decoded RTF \objdata at offset 0x3DE98 29243 bytes
SHA-256: 7e7b97bedb9475be6258dc408a29a98d0bea79b62f5f9a5cea9920130438e88f
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_04_off00051b42.bin rtf-objdata-decoded RTF \objdata at offset 0x51B42 29243 bytes
SHA-256: 3e617a2ae0e166ee72b30ba6e8be92db0173c35d686513783d8dfeb8283fe4c3
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_05_off000657ec.bin rtf-objdata-decoded RTF \objdata at offset 0x657EC 29243 bytes
SHA-256: c837a0a8b4f34ade72da23c5f6c9c451a831a46058c234c5170a2f5e257a9e1e
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_06_off00079496.bin rtf-objdata-decoded RTF \objdata at offset 0x79496 29243 bytes
SHA-256: 304de472a542205ffe9975d06fdde9c0aaac872186302d9e7e7365b9c9ca79c4
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_07_off0008d140.bin rtf-objdata-decoded RTF \objdata at offset 0x8D140 29243 bytes
SHA-256: ba593986957cdaa5f75189f1f57bdc4871b049795c926bad8e8c27d2dacc0d04
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_08_off000a0dea.bin rtf-objdata-decoded RTF \objdata at offset 0xA0DEA 29243 bytes
SHA-256: c5252b4e59ca4604cdfc9fc840c0c18a85eb7027ad78112e23fbf15d9fb47dd2
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely
objdata_09_off000b4a94.bin rtf-objdata-decoded RTF \objdata at offset 0xB4A94 29243 bytes
SHA-256: 044172e606f6f531addfa17a5c3aa595be49efe6b505bcd20e4ec3e9a3ff2ab3
Detection
ClamAV: Doc.Macro.Obfuscation-6391394-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.