RTF malware analysis — malicious · b78177747c5e70db

MALICIOUS

RTF

870.4 KB Created: 2017-11-20 19:24:00 First seen: 2017-12-08

MD5: 16cb8396c61630039d20da2704defc62 SHA-1: 20d21b0c96d64a32c8040e56e30bb170f000bd33 SHA-256: b78177747c5e70db4e9f3630f5db4893c381f5334f51c28ad48a4a3389efad50

422 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The RTF file contains OLE object data that triggers remote loading via CVE-2017-0199 or CVE-2017-8759. The embedded URL http://kinesk.com/t/t.php?stats=send&thread=2 is likely used to download and execute a secondary payload, as indicated by Metasploit shellcode and WinExec API references. The ClamAV detection also confirms its malicious nature as a downloader.

Heuristics 11

CVE-2017-0199 / CVE-2017-8759 (OLE2Link auto-activated remote loader) critical CVE related RTF_OLE2LINK_REMOTE_MONIKER_LOADER

RTF embeds an OLE2Link object that is force-activated with \objupdate (no user interaction on open) and fetches a remote second stage through an INCLUDETEXT/INCLUDEPICTURE field. This is the field-delivered OLE2Link auto-update attack path shared by CVE-2017-0199 (server returns an HTA/scriptlet) and CVE-2017-8759 (server returns a SOAP WSDL the .NET parser compiles). Office processes the fetched response through the same code path; the specific CVE depends on the now-unreachable server content type.
ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3

Metasploit reverse_tcp shellcode critical SC_MSF_REVERSE

Metasploit reverse_tcp shellcode

Disassembly

Attempted x86 opcode disassembly

0007103F  fc                cld
00071040  e882000000        call 0x710c7
00071045  5f                pop edi
00071046  5e                pop esi
00071047  5b                pop ebx
00071048  8be5              mov esp, ebp
0007104A  5d                pop ebp
0007104B  c3                ret
0007104C  8d4000            lea eax, [eax]
0007104F  53                push ebx
00071050  56                push esi
00071051  8bd8              mov ebx, eax
00071053  3b5324            cmp edx, dword ptr [ebx + 0x24]
00071056  7436              je 0x7108e
00071058  8bf2              mov esi, edx
0007105A  85f6              test esi, esi
0007105C  7518              jne 0x71076
0007105E  33c0              xor eax, eax
00071060  8a4318            mov al, byte ptr [ebx + 0x18]
00071063  8b048528ef4700    mov eax, dword ptr [eax*4 + 0x47ef28]
0007106A  50                push eax
0007106B  a1f06c4800        mov eax, dword ptr [0x486cf0]
00071070  8b00              mov eax, dword ptr [eax]
00071072  ffd0              call eax
00071074  8bd0              mov edx, eax
00071076  895324            mov dword ptr [ebx + 0x24], edx
00071079  c6434401          mov byte ptr [ebx + 0x44], 1
0007107D  8b4304            mov eax, dword ptr [ebx + 4]
00071080  e8ba060000        call 0x7173f
00071085  85f6              test esi, esi
00071087  7505              jne 0x7108e
00071089  33c0              xor eax, eax
0007108B  894324            mov dword ptr [ebx + 0x24], eax
0007108E  5e                pop esi
0007108F  5b                pop ebx
00071090  c3                ret
00071091  8bc0              mov eax, eax
00071093  3b5028            cmp edx, dword ptr [eax + 0x28]
00071096  7413              je 0x710ab
00071098  895028            mov dword ptr [eax + 0x28], edx
0007109B  c6402c00          mov byte ptr [eax + 0x2c], 0

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTE

RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// URL — Word can fetch the remote content on open depending on Office version and external-content settings, enabling remote template injection, NTLM capture via redirects, or payload delivery
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://kinesk.com/t/t.php?stats=send&thread=2 In RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000c568.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xC568	2598 bytes
SHA-256: `831d653a8bf6b35f70c34b8f0aa9b4deff313b9e99f06c2a160f156cfbe686ed`
`objdata_01_off0000dc96.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDC96	2674 bytes
SHA-256: `b2d1dcd53ab72d489708eb5449a9c003c690279daf375b527c7e12791399d9fe`

Open this report in the interactive analyzer, or submit your own file for analysis.