Malicious RTF — malware analysis report

Static analysis result for SHA-256 cbcee216e6c770f1…

MALICIOUS

RTF

841.8 KB Created: 2018-03-22 07:15:00 First seen: 2021-02-23
MD5: 9c1b6430a208c9307c6c3c9cb5045e2e SHA-1: 8e2c17b6e9000a618fb8e0ac176a4cff251c6623 SHA-256: cbcee216e6c770f133f26e348015568d6d44afaa61324572e3155a70a50b3106
242 Risk Score

Heuristics 6

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002922.bin rtf-objdata-decoded RTF \objdata at offset 0x2922 30267 bytes
SHA-256: ab3c498743d658d41a41b7a2fcd54c5821c089acc82272eb64d4f7a84d30a562
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_01_off00016d64.bin rtf-objdata-decoded RTF \objdata at offset 0x16D64 30267 bytes
SHA-256: 3d6ab4c8c1e92f5f81d8d7d34bf71f6353daa516e2da8e14c5cfe6f0e84ccd7f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_02_off0002b221.bin rtf-objdata-decoded RTF \objdata at offset 0x2B221 30267 bytes
SHA-256: 0314104c67ef126e4755806f8c349e92dbb2790c4fd014ded83d824079186b4e
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_03_off0003f6e0.bin rtf-objdata-decoded RTF \objdata at offset 0x3F6E0 30267 bytes
SHA-256: 9e63fadb9037e0584804a28a4e228fa185a6f384055036b61782c7af6b7785b8
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_04_off00053b9f.bin rtf-objdata-decoded RTF \objdata at offset 0x53B9F 30267 bytes
SHA-256: aadc685de8d087d167646c22e33e0a17854b26ad83d6c5e16b653f5ce4259f1f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_05_off0006805e.bin rtf-objdata-decoded RTF \objdata at offset 0x6805E 30267 bytes
SHA-256: ee4236a0b0b95b847df720496b90a515500d0793822c981dab35bfee0ed37d87
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_06_off0007c51d.bin rtf-objdata-decoded RTF \objdata at offset 0x7C51D 30267 bytes
SHA-256: a7460b123811061e3a53a3865f2232cdfcd037dd2cb3659c1d909ff01d5d2353
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_07_off000909dc.bin rtf-objdata-decoded RTF \objdata at offset 0x909DC 30267 bytes
SHA-256: bc699dbf565f871d7f0a993b7a2c60f2029d896732c59a3902b7953d23ae5d2e
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_08_off000a4e9b.bin rtf-objdata-decoded RTF \objdata at offset 0xA4E9B 30267 bytes
SHA-256: a33eab12906995c2c6c1529b8e5c37a128549a382dd8cfd0c9cbbaa3a772db5b
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_09_off000b935a.bin rtf-objdata-decoded RTF \objdata at offset 0xB935A 30267 bytes
SHA-256: c8ead7b73dcb1a72fc8a866ab6c7cdd80cd109b7dfe7176bfef73e929c9177e3
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.