Malicious RTF — malware analysis report

Static analysis result for SHA-256 923a8eab7773b5be…

MALICIOUS

RTF

1.09 MB Created: 2019-09-17 13:59:00 First seen: 2020-09-07
MD5: 668bbdb5e10f7c23e90a1019aa50b481 SHA-1: 60054eb7fb0ddd9ceb3bb637f3e9ff1bc35aba12 SHA-256: 923a8eab7773b5be5e3e380de1505a2c6c71f7b82329e9f3b3ff1461dc057610
202 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is an RTF document containing an embedded OLE object, which is configured to update via \objupdate. This indicates an attempt to exploit CVE-2017-8759, a known vulnerability in MSXML that allows for remote code execution when processing OLE objects. The ClamAV detection of Rtf.Dropper.Agent-7701533-0 further confirms its malicious nature as a dropper. The benign URL found is not indicative of malicious activity.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Rtf.Dropper.Agent-7701533-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7701533-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00111c64.bin rtf-objdata-decoded RTF \objdata at offset 0x111C64 1413 bytes
SHA-256: 10dab3d2c00587078822690675791f429238e3ac6b1d2635347a5569727f469b

Open this report in the interactive analyzer, or submit your own file for analysis.