Malicious RTF — malware analysis report

Static analysis result for SHA-256 b76bda83b8c17f87…

MALICIOUS

RTF

550.5 KB First seen: 2019-05-16
MD5: dc663a6e31383d2b544a2f956726752b SHA-1: 99fd1623323cc10cc2a12a6eec177ac023b85d69 SHA-256: b76bda83b8c17f87b58fa9b32df749129775d01963c15a70d7af00b5e3b747b3
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE objects and triggers CVE-2017-8570 via a Composite Moniker. This vulnerability is known to drop and execute a script, likely leading to further malicious activity. The embedded URLs suggest a potential phishing or credential harvesting attempt.

Heuristics 6

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 7 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dogovor-obrazets.ru/��������������/������������/48160 In RTF body
    • https://dogovor-obrazets.ruIn RTF body
    • http://www.w3.org/TR/REC-html40In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000025.bin rtf-objdata-decoded RTF \objdata at offset 0x25 229 bytes
SHA-256: bdf6de0a64b3411ca5229f989a8704bb9f2ac8eac0d3b0c83ab62136585dd012
objdata_01_off0000021a.bin rtf-objdata-decoded RTF \objdata at offset 0x21A 257251 bytes
SHA-256: 338c06786508ddf74b3b14d051e805bcd3d1af81c832d088e68baefbd26b5136
objdata_02_off00081992.bin rtf-objdata-decoded RTF \objdata at offset 0x81992 1586 bytes
SHA-256: 52c18e7f25a29383cfa4b9958e342cb55e4f1deadf7f82b3501536f06bf619da
objdata_03_off00082629.bin rtf-objdata-decoded RTF \objdata at offset 0x82629 10718 bytes
SHA-256: 8497c95bbe6ab795952b22861222de48ad9e854ebcde8643d95efa27c5590d34
objdata_04_off00087a17.bin rtf-objdata-decoded RTF \objdata at offset 0x87A17 399 bytes
SHA-256: dc3da5e38801b5fa23cf99248f674a9b06d9120c119f995001155e4bc263978f
objdata_05_off00087d69.bin rtf-objdata-decoded RTF \objdata at offset 0x87D69 937 bytes
SHA-256: e21955e19ee5e9c33caa29d20574aba20d6cc02b855734ac20377ad351eddf3c
objdata_06_off00088522.bin rtf-objdata-decoded RTF \objdata at offset 0x88522 2633 bytes
SHA-256: 27c6d10cfe7974ebf40c1200cc005f9878cc37b7d49ece9cbc396d700c38918a

Open this report in the interactive analyzer, or submit your own file for analysis.