Malicious RTF — malware analysis report

Static analysis result for SHA-256 bb8c9e61c45bf9b1…

MALICIOUS

RTF

41.5 KB Created: 2017-11-14 23:10:00 First seen: 2017-11-20
MD5: 650bc9537cba950118653d0e5f9e8c20 SHA-1: 059e27ec16ce90bbc519df55232a2d194ed7baf4 SHA-256: bb8c9e61c45bf9b1deca520321e4af3bf5de9b377c40cb1f94368c3c0db9df06
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and is flagged for CVE-2017-8759, indicating exploitation of a SOAP Moniker vulnerability. This technique is commonly used to download and execute arbitrary code. The presence of an automatically linked OLE object further supports this attack vector. ClamAV also identifies the file as a downloader.

Heuristics 5

  • SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) critical CVE related CVE_2017_8759
    RTF \objdata decodes to OLE data containing the SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000027dd.bin rtf-objdata-decoded RTF \objdata at offset 0x27DD 3640 bytes
SHA-256: fa3d1fe43fa2fb1cd92e20fb056dbbfbcc2c025d59ca3e5f81bf6c80b7ff9d1c

Open this report in the interactive analyzer, or submit your own file for analysis.