Malicious RTF — malware analysis report

Static analysis result for SHA-256 93bd768a805bbaac…

MALICIOUS

RTF

159.3 KB Created: 2017-11-23 01:06:00 First seen: 2018-12-09
MD5: 44fcb4c845b258a1a89017bc687b6c16 SHA-1: 544f530da3e31849788f8d2b8b66c7a11af0d354 SHA-256: 93bd768a805bbaac9e227411e0f5b172c12dd07a8d6ae89b5b23ef4948a5333c
240 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains multiple critical heuristic firings indicating exploitation of CVE-2017-8570 and CVE-2018-0802 via embedded OLE objects and the Equation Editor. These exploits are known to drop SCT scripts, which are then executed to further compromise the system. The presence of OLE object data and specific CLSIDs strongly suggests an exploit chain designed for arbitrary code execution.

Heuristics 5

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 8 \objdata section(s) — embedded OLE objects

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00009f15.bin rtf-objdata-decoded RTF \objdata at offset 0x9F15 711 bytes
SHA-256: 831a62fb9498bd93990d1fc19181a7f5fbff6d177f0d1ec620da13d11958843e
objdata_01_off0000a6fb.bin rtf-objdata-decoded RTF \objdata at offset 0xA6FB 929 bytes
SHA-256: 667dbfea841acf5cd74cb5931fd69d9aa485df8139583c1ea1fc4c4fb47ced47
objdata_02_off0000b095.bin rtf-objdata-decoded RTF \objdata at offset 0xB095 952 bytes
SHA-256: b7537e894f819396e08ff159265a8f5ffa36bc03237978f7ad13e1b943fdc6fa
objdata_03_off0000ba88.bin rtf-objdata-decoded RTF \objdata at offset 0xBA88 3271 bytes
SHA-256: 3e4de491815c0ad3cf30a6f9cb6e81dfae7c19f1bc0f033dcb01ed50ca70124d
objdata_04_off0000d8d5.bin rtf-objdata-decoded RTF \objdata at offset 0xD8D5 2638 bytes
SHA-256: 93250b41d080583eceedf9bf435d55bf501e0f079d177680e3827b7bf6d467dc
objdata_05_off0000f01f.bin rtf-objdata-decoded RTF \objdata at offset 0xF01F 4682 bytes
SHA-256: 373cb9f4ca97b71625ada2e68ccc0a9e90822511310724572a4f3e518ba5da11
objdata_06_off00011753.bin rtf-objdata-decoded RTF \objdata at offset 0x11753 3980 bytes
SHA-256: 79fd72940afd5cc2311bfba9c9ac5623dfb520141a8cdf7213e85dbde70d98f8
objdata_07_off0001390d.bin rtf-objdata-decoded RTF \objdata at offset 0x1390D 2601 bytes
SHA-256: dd6a4f087a2b16199fa33718649303fcf7b7967830a664669ef6e8b0c67d4c92

Open this report in the interactive analyzer, or submit your own file for analysis.