Win.Malware.Remcos-6960206-0 — RTF malware analysis

Static analysis result for SHA-256 94977874d079cb11…

MALICIOUS

RTF

2.04 MB First seen: 2019-08-04
MD5: cb377888b77449169c733be92091f73c SHA-1: e5c907ce09e8c3b109ed09081f03def1063d07ef SHA-256: 94977874d079cb11410f56c2431a1d6d8e810c369a64cbeacb2126f107d1fcbc
502 Risk Score

Malware Insights

Win.Malware.Remcos-6960206-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple critical heuristic firings indicating exploitation of CVE-2017-8570 and CVE-2017-11882 through embedded OLE objects, specifically targeting the Equation Editor. This process likely drops a second-stage payload, as suggested by the presence of a PE header within the hex-encoded OLE data and a ClamAV detection of Win.Malware.Remcos-6960206-0 on the file and an extracted artifact. The embedded URL 'http://test1.ru/newbuild/t.php?act=hit' is likely used for payload delivery.

Heuristics 11

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • CVE-2017-11882/0802 — suspicious Equation font record high CVE likely CVE_2017_11882
    RTF contains Equation Editor data with an anomalous MTEF font record shape. This is a static indicator for Equation Editor font-record overflow CVE families, stronger than CLSID presence.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Win.Malware.Remcos-6960206-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Malware.Remcos-6960206-0
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~2133KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 8 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://test1.ru/newbuild/t.php?act=hit In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000002f.bin rtf-objdata-decoded RTF \objdata at offset 0x2F 887 bytes
SHA-256: 63c0c8928d7dba416d73c39a7f0eaf44893fd70add55efa5088566e0f4599c0d
objdata_01_off00018d7e.bin rtf-objdata-decoded RTF \objdata at offset 0x18D7E 32665 bytes
SHA-256: 7bc9ec1f0f651f44d55c29c2418a62c6073ac32e2c7b9aaefcfd115ed3f57211
objdata_02_off00028ce8.bin rtf-objdata-decoded RTF \objdata at offset 0x28CE8 482 bytes
SHA-256: 5335740b0cd34b41db1162eb5c2c304105d851714fd2d00522c05285a960dc0e
objdata_03_off000290e8.bin rtf-objdata-decoded RTF \objdata at offset 0x290E8 815 bytes
SHA-256: 715448127c85e8696ae7bc145be5f7c9fd53c9299e296ab30d9a6e529b53c2f9
objdata_04_off000297b7.bin rtf-objdata-decoded RTF \objdata at offset 0x297B7 2633 bytes
SHA-256: 1feb5f150bb35566d1a01fc59a357dc0ea34bc7498e0ec99bd939f6f848044b0
objdata_05_off0002acc4.bin rtf-objdata-decoded RTF \objdata at offset 0x2ACC4 4681 bytes
SHA-256: c4bb3f784feda536c3c8a254c5e4985ff95fb94510d6c6900c5e6ad04d5ce6fc
objdata_06_off0002d5bb.bin rtf-objdata-decoded RTF \objdata at offset 0x2D5BB 975052 bytes
SHA-256: b622d107997bf13ec0b5c9aa023fa1b42464f8c58cd31c117cd3b11b4d1be682
Detection
ClamAV: Win.Malware.Remcos-6960206-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.