Malicious RTF — malware analysis report

Static analysis result for SHA-256 c9e9c5cb9b717af8…

MALICIOUS

RTF

41.5 KB Created: 2017-11-15 16:38:00 First seen: 2017-11-20
MD5: 3fad6a88062ffbd46d8477ee1ef317f2 SHA-1: 728a5a1dd1d8b29d0c9a753e7d98cb7241a6961b SHA-256: c9e9c5cb9b717af8d88d57d2e84b74ff8bc0e3dfdc78fb6dceb49e4692ae17f3
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and is flagged for CVE-2017-8759, indicating exploitation of a SOAP Moniker vulnerability. This technique is commonly used to download and execute arbitrary code. The presence of an automatically linked OLE object further supports this attack vector. ClamAV also identifies the file as a downloader.

Heuristics 5

  • SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) critical CVE related CVE_2017_8759
    RTF \objdata decodes to OLE data containing the SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000027e7.bin rtf-objdata-decoded RTF \objdata at offset 0x27E7 3640 bytes
SHA-256: e7e898b55e4c739240fd7ff4f9a93aed900a460fd6dc28074ac2886f12e18aaf

Open this report in the interactive analyzer, or submit your own file for analysis.