RTF malware analysis — malicious · 90b34f6fbc2da914

MALICIOUS

RTF

112.8 KB Created: 2010-11-29 16:43:00 Authoring application: Microsoft Word 11.0.0000 First seen: 2015-10-01

MD5: af3492169e8907ffa5c813219e0fb9a8 SHA-1: bf8d5829f40b876c80084faeab052b77a00f2ada SHA-256: 90b34f6fbc2da914394ecd1376e52031aa7de802eaf7f6d6c0ae04bc4ddc23e9

62 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The sample is an RTF file that contains OLE object data. A high-severity heuristic identified the CVE-2012-0158 vulnerability, which is associated with MSCOMCTL.ListView. This indicates the file is designed to exploit this client-side vulnerability for code execution. No specific malware family could be identified.

Heuristics 3

MSCOMCTL.ListView — CVE-2012-0158 high CVE related CVE_2012_0158

RTF \objdata decodes to OLE data containing the MSCOMCTL.ListView — CVE-2012-0158 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000f6.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xF6	4751 bytes
SHA-256: `97c6dfc9c134bca824d324523a301f1e5b6efc99288173c92bc5c7351279be74`

Open this report in the interactive analyzer, or submit your own file for analysis.