RTF malware analysis — malicious · 91afaa1d6cce8993

MALICIOUS

RTF

192.0 KB Created: 2018-07-13 13:10:00 First seen: 2021-02-23

MD5: 9f300dd0703e833095e454cafeaa29e9 SHA-1: d6bdb5bd1fabc982293bcb566570bd0bbae83dbb SHA-256: 91afaa1d6cce89930f825f5281a6bac7b60b0f7a7f9405efac74b7b8164e7853

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c2c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C2C	24635 bytes
SHA-256: `fd5530cd3dd49bdb8c3037ab194bc4aa17acb12283b75d03f9ad9c56a32f37a0`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off0001546e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1546E	24635 bytes
SHA-256: `2a42e221f12c036052ebf4ab51758cc64ecf7d5f0044df97a853018eb11ebbba`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026cb0.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CB0	18705 bytes
SHA-256: `29ed3841fc8d9123d80a4a94cfebd7afc114f179d8fbe028c49812642b8a53ba`

Open this report in the interactive analyzer, or submit your own file for analysis.