RTF malware analysis — malicious · b038e34a79de4ca3

MALICIOUS

RTF

5.1 KB First seen: 2018-03-04

MD5: 5a555b031aa457970e326245a4f3147b SHA-1: a255d6b411df6cc046cc68e96eecd401db1d314f SHA-256: b038e34a79de4ca399f8d70945dc43d1f3feb52e0a9f0834dead0a155367aa97

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains an OLE2Link object that is automatically activated via ".objupdate". This object is configured to load a remote payload, exploiting CVE-2017-0199 or CVE-2017-8759. The second stage is embedded within the OLE moniker stream, indicating a direct download and execution mechanism. No specific family could be identified, but the exploit chain is clear.

Heuristics 4

CVE-2017-0199 / CVE-2017-8759 (OLE2Link auto-activated remote loader) critical CVE related RTF_OLE2LINK_REMOTE_MONIKER_LOADER

RTF embeds an OLE2Link object that is force-activated with \objupdate (no user interaction on open) and fetches a remote second stage — through an INCLUDETEXT/INCLUDEPICTURE field or the OLE object's own moniker. This is the OLE2Link auto-update attack path shared by CVE-2017-0199 (server returns an HTA/scriptlet) and CVE-2017-8759 (server returns a SOAP WSDL the .NET parser compiles). Office processes the fetched response through the same code path; the specific CVE depends on the now-unreachable server content type.
Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000004f.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x4F	2570 bytes
SHA-256: `85853eef3e4993124bc1abdfd0f032bbb1bd01644bfa9958bdd2a091ca6d634f`

Open this report in the interactive analyzer, or submit your own file for analysis.