Malicious RTF — malware analysis report

Static analysis result for SHA-256 c85a03d7272b4268…

MALICIOUS

RTF

269.8 KB Created: 2018-12-20 17:04:00 First seen: 2019-04-17
MD5: 7f2bc6d9489ab0572a6d1d3eb907bf33 SHA-1: 4fa191423aeb06a0b6d3593d023e98378cc9f94a SHA-256: c85a03d7272b42683ede20fc256ec356f45d9f640af20396c9c0b79d6c933e20
210 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and triggers heuristics related to CVE-2017-8570, indicating an attempt to exploit this vulnerability. The exploit likely involves dropping a script file, which is a common method for initial execution. The document body, formatted as an invoice or event agreement, serves as a lure to encourage the user to open the malicious content.

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • URL Moniker in RTF OLE object high CVE related RTF_URL_MONIKER_RELATED
    RTF contains a URL Moniker GUID in OLE object context, but no decoded remote target was confirmed. Treat as related OLE2Link attack-surface evidence rather than proof of CVE-2017-0199 exploitation.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.marriott.com/about/privacy.mi In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body
    • https://protect-us.mimecast.com/s/SER-CG6QzAUg2xQpIWyIbYIn RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000c0d0.bin rtf-objdata-decoded RTF \objdata at offset 0xC0D0 4649 bytes
SHA-256: d1226f759398dab65994c4055cf2786f2d717dbe893f6e1d08635fada22b7a21

Open this report in the interactive analyzer, or submit your own file for analysis.