Xls.Malware.Valyria-6934880-0 RTF malware analysis — malicious · b3e9cdcba703539a

MALICIOUS

RTF

732.6 KB Created: 2018-02-07 20:09:00 First seen: 2018-02-19

MD5: c26fa78766da89c0c66a59a4be1308ed SHA-1: ff46b26ca00c0ab00495647389496401803c81d9 SHA-256: b3e9cdcba703539a82525d85d30353c230a4b289f6289f2e3d76b3d62388f4e7

262 Risk Score

Malware Insights

Xls.Malware.Valyria-6934880-0 · confidence 95%

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and uses \objupdate to force their activation. Critical heuristics indicate exploitation of CVE-2017-8759, a known vulnerability in MSXML that allows for OLE object activation. ClamAV detections confirm this is a malicious Excel variant, likely Valyria, which typically downloads and executes further stages. The embedded OLE objects are the primary mechanism for this execution.

Heuristics 6

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
ClamAV: Xls.Malware.Valyria-6934880-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-6934880-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 10 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002c22.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2C22	22587 bytes
SHA-256: `36f37d0d63b05dcb86f25f064d3fd79c967da771a8149275c52451403215435b`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_01_off0001382e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1382E	22587 bytes
SHA-256: `23c44d2b17cab78d23f966d2c62e0069510bd2e21e78732aa3bae540ed0cdf9b`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_02_off000243af.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x243AF	22587 bytes
SHA-256: `034f22207233c05a3f1a1a0fc3fb6454a04e00cf1b636b5052c8188d623590de`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_03_off00034f32.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x34F32	22587 bytes
SHA-256: `3f8dc3bda03086c25504d8f2cdfba40c26b739bcc8f404a9a00c2b90f2eee6d2`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_04_off00045ab5.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x45AB5	22587 bytes
SHA-256: `ccd479ca1e87fe6055b293d7d052376b71fc0e1644df276ac43b1a8026270145`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_05_off00056638.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x56638	22587 bytes
SHA-256: `675364e934f863ffaf24428a8ea9d499bf320848d71c4edb23d3b26608750206`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_06_off000671bb.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x671BB	22587 bytes
SHA-256: `7456aa89cd056e26249f5cef962796b47040ebae3d9b36f7771597988e3f82ba`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_07_off00077d3e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x77D3E	22587 bytes
SHA-256: `378eac3a14e9cb108f3f91380cc75dee6728288303258187f96ace53f5909c8a`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_08_off000888c1.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x888C1	22587 bytes
SHA-256: `8eb1d62c00d39151093c89f01027127b4e92ca99b5eff089b0c6577f2fd77f9b`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely
`objdata_09_off00099444.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x99444	22587 bytes
SHA-256: `a82da1c0568d23a7d9146420c9105ac96d98b32dce6c2e1c4488746886f638ef`
Detection ClamAV: Xls.Malware.Valyria-6934880-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.