Malicious RTF — malware analysis report

Static analysis result for SHA-256 c8223c74d8ef62ec…

MALICIOUS

RTF

37.3 KB Created: 2017-11-14 10:33:00 First seen: 2017-11-20
MD5: 7b14178637f5425f0e1f8fc2f5965ac9 SHA-1: fc095faf2935635437206086728d31e75d13753c SHA-256: c8223c74d8ef62ec7888f76d20e3562df74dab3c95b93a223bc9a4eb6310ba7e
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and is flagged for CVE-2017-8759, indicating exploitation of a SOAP Moniker vulnerability. This technique is commonly used to download and execute arbitrary code. The presence of an automatically linked OLE object further supports this attack vector. ClamAV also identifies the file as a downloader.

Heuristics 5

  • SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) critical CVE related CVE_2017_8759
    RTF \objdata decodes to OLE data containing the SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002786.bin rtf-objdata-decoded RTF \objdata at offset 0x2786 3640 bytes
SHA-256: 3b9bf4b5f709aca2fe662549d03d1c25adb578282b16477fd0c692cc5de22ccb

Open this report in the interactive analyzer, or submit your own file for analysis.