Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 d1256405fe547aca…

MALICIOUS

RTF / .DOC

321.6 KB Created: 2023-08-01 09:53:00 First seen: 2023-08-02
MD5: 6f02b04d28876040ebf2534fad615c94 SHA-1: 474372fc1a386659048a52c9f815c5eaa8d1ec28 SHA-256: d1256405fe547acad3aa7e3870f0f623fa30710957d1072c747700193b417c95
242 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.002 Malicious File T1059 Command and Scripting Interpreter T1059.003 Windows Command Shell T1566 Phishing T1566.001 Spearphishing Attachment

The RTF document contains embedded OLE objects and triggers multiple critical heuristics related to CVE-2017-8570 and CVE-2017-8759. These vulnerabilities allow for the execution of arbitrary code, likely by dropping and executing a script. The document body appears to be a disguised purchase order, a common lure for malicious documents.

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00015c55.bin
00756a999161c49e5bc68c1bf8b8d0f59311abe71f7519518844f683e340fb89		 rtf-objdata-decoded RTF \objdata at offset 0x15C55 25000 bytes
objdata_01_off00022813.bin
2f4e481fc703308b3ea4be7a52293e9bb733c26dcf8c28b432fb99357e0cfb38		 rtf-objdata-decoded RTF \objdata at offset 0x22813 2632 bytes
objdata_02_off00023db6.bin
142dc43284d9abe994719f8fb67bc4c04bfc3f07528a1a66b0bad7e552ee8e78		 rtf-objdata-decoded RTF \objdata at offset 0x23DB6 12297 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.