Gandcrab — RTF malware analysis

Static analysis result for SHA-256 c9436c1cff87d06f…

MALICIOUS

RTF

664.4 KB First seen: 2019-01-20
MD5: ea071373764a0af3ba68fa087d9cd8d9 SHA-1: 0dd732a0e48b4da832539e5a7c51824be27decc9 SHA-256: c9436c1cff87d06f8c4a37c6cbef508e2ffba62f71418184b476d77d3dccc2d3
424 Risk Score

Malware Insights

Gandcrab · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple critical heuristic firings indicating the exploitation of CVE-2017-8570 through an embedded OLE object, specifically leveraging the Equation Editor. ClamAV detections confirm this as Win.Dropper.Gandcrab-7077551-0, suggesting it acts as a dropper for the Gandcrab ransomware. The embedded OLE object likely contains shellcode or a script designed to download and execute the final payload.

Heuristics 10

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Win.Dropper.Gandcrab-9805973-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.Gandcrab-9805973-0
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 8 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nsis.sf.net/NSIS_Error In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000002f.bin rtf-objdata-decoded RTF \objdata at offset 0x2F 887 bytes
SHA-256: 63c0c8928d7dba416d73c39a7f0eaf44893fd70add55efa5088566e0f4599c0d
objdata_01_off00004220.bin rtf-objdata-decoded RTF \objdata at offset 0x4220 612 bytes
SHA-256: c62851521e10316dfd43f2b6ee67cc27e2a24456bb346c8fa9dc4a6d6e21d526
objdata_02_off00004720.bin rtf-objdata-decoded RTF \objdata at offset 0x4720 482 bytes
SHA-256: 5335740b0cd34b41db1162eb5c2c304105d851714fd2d00522c05285a960dc0e
objdata_03_off00004b20.bin rtf-objdata-decoded RTF \objdata at offset 0x4B20 815 bytes
SHA-256: 715448127c85e8696ae7bc145be5f7c9fd53c9299e296ab30d9a6e529b53c2f9
objdata_04_off000051ef.bin rtf-objdata-decoded RTF \objdata at offset 0x51EF 2633 bytes
SHA-256: 1feb5f150bb35566d1a01fc59a357dc0ea34bc7498e0ec99bd939f6f848044b0
objdata_05_off000066fc.bin rtf-objdata-decoded RTF \objdata at offset 0x66FC 4681 bytes
SHA-256: c4bb3f784feda536c3c8a254c5e4985ff95fb94510d6c6900c5e6ad04d5ce6fc
objdata_06_off00008ff3.bin rtf-objdata-decoded RTF \objdata at offset 0x8FF3 321738 bytes
SHA-256: 2fa2c65c0835bbbb77e76fe2295558341295de0937571ea61200ac09550ee93b
Detection
ClamAV: Win.Dropper.Gandcrab-9805973-0
Obfuscation or payload: likely
Carved artifact entropy is 7.94, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.