Malicious RTF — malware analysis report

Static analysis result for SHA-256 b38d57eb48fe8d2f…

MALICIOUS

RTF

160.0 KB Created: 2018-07-13 12:26:00 First seen: 2021-02-23
MD5: 5c61b3f928b96ad5f1ca0ce115074454 SHA-1: cadb4d955e55770d2d9a48b050328133bff7f77d SHA-256: b38d57eb48fe8d2f69be9754a45cfb5f00ea1e48a7dd4edc77ab718ff5429e23
242 Risk Score

Heuristics 6

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003c43.bin rtf-objdata-decoded RTF \objdata at offset 0x3C43 25147 bytes
SHA-256: 77d5a22b1ccc63c5816ff6fd7aa7c08b67b7374e4216fef0e37ac9695f0f3288
Detection
ClamAV: Xls.Malware.Sload-7135989-0
Obfuscation or payload: unlikely
objdata_01_off000158fe.bin rtf-objdata-decoded RTF \objdata at offset 0x158FE 25147 bytes
SHA-256: 897a7f2fd06b6387a17db4523a8449fa61809acc3b2d7838843ccc344e03e4f4
Detection
ClamAV: Xls.Malware.Sload-7135989-0
Obfuscation or payload: unlikely
objdata_02_off000275b9.bin rtf-objdata-decoded RTF \objdata at offset 0x275B9 1304 bytes
SHA-256: a98e89f8daba9a2579d013de0a2b2e42f4f36328a8440c30f458f6293107cde2

Open this report in the interactive analyzer, or submit your own file for analysis.