Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 959837140aee207e…

MALICIOUS

RTF / .DOC

216.4 KB First seen: 2022-09-23
MD5: 9bc102ffb0930f5dee65bde8e0ba6d89 SHA-1: 37cac7507a6ad02a75d947a9bdfe115f2da8b71b SHA-256: 959837140aee207e9fd845a030881f9430364d2df8088845f5828579420b1717
180 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution T1559.002 Component Object Model Hijacking

The RTF file contains embedded OLE objects with composite monikers, triggering heuristics for CVE-2017-8570. This vulnerability allows for the dropping and execution of a script, likely a second-stage payload. The file's structure and the specific vulnerability exploited indicate a malicious intent to compromise the user's system.

Heuristics 5

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000007d5.bin
055547908dd2c61b91c490f04a44b40b72579002df62534e67d7b6fdf7b27d8e		 rtf-objdata-decoded RTF \objdata at offset 0x7D5 15105 bytes
objdata_01_off0000832d.bin
a972f385591d50d8ef9b0e90b730f6ae627bd35d8f72dc0fb5aa0b59c4a71d1a		 rtf-objdata-decoded RTF \objdata at offset 0x832D 2632 bytes
objdata_02_off000098d0.bin
142dc43284d9abe994719f8fb67bc4c04bfc3f07528a1a66b0bad7e552ee8e78		 rtf-objdata-decoded RTF \objdata at offset 0x98D0 12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.