Xls.Downloader.Generic-6750544-0 — RTF malware analysis

Static analysis result for SHA-256 bb546ff62175b283…

MALICIOUS

RTF

874.4 KB Created: 2018-02-15 11:27:00 First seen: 2018-02-19
MD5: fecfb6499dba777fe6aa5f4b16645a80 SHA-1: 6c2d59677f5d562a98cb13fd9327e78be676c184 SHA-256: bb546ff62175b2834602e515489fa18ab2e512af4150422d12d181a496a00050
262 Risk Score

Malware Insights

Xls.Downloader.Generic-6750544-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects, with heuristics indicating that \objupdate forces OLE activation. Critical firings for CVE-2017-8759 and ClamAV detection confirm this is a malicious downloader. The embedded OLE object is likely used to download and execute a secondary payload, consistent with the ClamAV family name.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002d98.bin rtf-objdata-decoded RTF \objdata at offset 0x2D98 27707 bytes
SHA-256: 7b0e34c19973a28a170241dac8160047fc505903ebd76e3456292e18e1accd8e
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_01_off000176b8.bin rtf-objdata-decoded RTF \objdata at offset 0x176B8 27707 bytes
SHA-256: efb184d23cb0d66e34ddc14926321979392c02bc6f3141c6c022cca6d00db55b
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_02_off0002c513.bin rtf-objdata-decoded RTF \objdata at offset 0x2C513 27707 bytes
SHA-256: 85608ed1e78af4a790fb7b00297180d532f6a633f659dec97fd009348d477e71
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_03_off0004136c.bin rtf-objdata-decoded RTF \objdata at offset 0x4136C 27707 bytes
SHA-256: 7be349995b7f0959ff3db13c347a5717ba163bcef2ce0c2b8de13c1d9f9e6c2f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_04_off000561c5.bin rtf-objdata-decoded RTF \objdata at offset 0x561C5 27707 bytes
SHA-256: f11d82bde4299da8a68ac21a1ce54b73fe340af8deaee1ee5670ef7167011f46
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_05_off0006b18d.bin rtf-objdata-decoded RTF \objdata at offset 0x6B18D 27707 bytes
SHA-256: 72d42fe0fddf579b86e4344458795707e3fab55e0676c41c38275c48c8c9511f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_06_off0007fa28.bin rtf-objdata-decoded RTF \objdata at offset 0x7FA28 27707 bytes
SHA-256: 036c99e85b87d2c367d77b5c63cd1031bb612c33c90e150ce7da566b1bd65d86
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_07_off00094881.bin rtf-objdata-decoded RTF \objdata at offset 0x94881 27707 bytes
SHA-256: b44894c928d650e91362552324da6c9159454efe6c3e3c8464dca5fcacb28428
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_08_off000a96da.bin rtf-objdata-decoded RTF \objdata at offset 0xA96DA 27707 bytes
SHA-256: 19b4b6b010e4b0e4aad03b369ee502b4dd701524c395215da1fcfa9423cc18fb
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_09_off000be533.bin rtf-objdata-decoded RTF \objdata at offset 0xBE533 27707 bytes
SHA-256: f02bdbf9f71b7e6c0c675ee4034316588f432fd5aac428b7c3cd1e1e0276d904
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.