LokiBot — RTF malware analysis

Static analysis result for SHA-256 b46fdb3a03d6905d…

MALICIOUS

RTF

1.82 MB First seen: 2019-05-16
MD5: 486ca2c52e9ef6e7701006e4e45ceb19 SHA-1: bcd69f245e974b0b81aad616b85444f8bb5fd43e SHA-256: b46fdb3a03d6905d241e009a1a6df6352ae79bc3efe0c636fc07eabbe4dc4718
464 Risk Score

Malware Insights

LokiBot · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains multiple indicators of exploitation targeting Equation Editor, specifically related to CVE-2017-8570. This vulnerability is known to be used for dropping SCT scripts, which are then likely executed to download and run further malicious payloads. ClamAV detection confirms the presence of LokiBot, a known information stealer and dropper.

Heuristics 11

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Win.Dropper.LokiBot-9164499-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.LokiBot-9164499-0
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1894KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 7 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.usertrust.com1 In RTF body
    • http://ocsp.usertrust.com0In RTF body
    • http://ns.adobe.com/xap/1.0/In RTF body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In RTF body
    • http://purl.org/dc/elements/1.1/In RTF body
    • http://ns.adobe.com/xap/1.0/mm/In RTF body
    • http://ns.adobe.com/tiff/1.0/In RTF body
    • http://ns.adobe.com/exif/1.0/In RTF body
    • http://ns.adobe.com/photoshop/1.0/In RTF body
    • http://www.iec.chIn RTF body
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn RTF body
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn RTF body
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn RTF body
    • http://crl.usertrust.com/UTN-USERFirst-Object.crl05In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000002c.bin rtf-objdata-decoded RTF \objdata at offset 0x2C 884 bytes
SHA-256: 08cb831cfd094f7193857584f98ebb419e336c73f0191f78a94fb322b6fcad85
objdata_01_off0006d48f.bin rtf-objdata-decoded RTF \objdata at offset 0x6D48F 174284 bytes
SHA-256: e2220fe69ae64c9a9d72716fd3d413aeb114813cdafd955a98ac62d285a98061
objdata_02_off000c265a.bin rtf-objdata-decoded RTF \objdata at offset 0xC265A 549428 bytes
SHA-256: 7973778586acfbad10e9a244667195cdf32bd955ffe74700a740d27e0f3ef2ed
Detection
ClamAV: Win.Dropper.LokiBot-9164499-0
Obfuscation or payload: likely
Carved artifact entropy is 7.81, consistent with packed or encrypted content.
objdata_03_off001ceb00.bin rtf-objdata-decoded RTF \objdata at offset 0x1CEB00 382 bytes
SHA-256: 7c829894502990522aaee3764e10dad03b3c7476dec48c4e1d128bb9b9774910
objdata_04_off001cee30.bin rtf-objdata-decoded RTF \objdata at offset 0x1CEE30 789 bytes
SHA-256: 87caf099a20fd4563d975979583365d98bc376a5fd992193cf5da7686fc18198
objdata_05_off001cf4c1.bin rtf-objdata-decoded RTF \objdata at offset 0x1CF4C1 2633 bytes
SHA-256: 1feb5f150bb35566d1a01fc59a357dc0ea34bc7498e0ec99bd939f6f848044b0
objdata_06_off001d09cb.bin rtf-objdata-decoded RTF \objdata at offset 0x1D09CB 4679 bytes
SHA-256: 0e2ce9d01b0df41beca1d9d003ff4bfe3998a96192a53992dd35145a081e0a27

Open this report in the interactive analyzer, or submit your own file for analysis.