Malicious RTF — malware analysis report

Static analysis result for SHA-256 dbb2e410c0069b39…

MALICIOUS

RTF

1.15 MB First seen: 2019-11-20
MD5: 4c945b6a81c128ae8b18b6380811e9cd SHA-1: 3ea5ab754a4e953b4172351d89a4dbb1fbe09fa3 SHA-256: dbb2e410c0069b3916024873f6d4df0ed6f08cfcf48e29dc852ebd1b19339661
482 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1027 Obfuscated Files or Information

The RTF file contains multiple indicators of exploitation for CVE-2017-8570, including the use of Composite Moniker and OLE object data. The embedded OLE object contains a PE header in hex data, suggesting it is a payload. The heuristic firings and the presence of an embedded URL point towards the execution of a second-stage payload from the malicious URL.

Heuristics 11

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Win.Malware.Delf-6696577-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Malware.Delf-6696577-0
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1207KB of hex-encoded data inside \objdata sections — may hide a payload
  • OLE object data medium RTF_OBJDATA
    RTF contains 8 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://test1.ru/newbuild/t.php?act=hit In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000002f.bin rtf-objdata-decoded RTF \objdata at offset 0x2F 887 bytes
SHA-256: 63c0c8928d7dba416d73c39a7f0eaf44893fd70add55efa5088566e0f4599c0d
objdata_01_off00018d7e.bin rtf-objdata-decoded RTF \objdata at offset 0x18D7E 32665 bytes
SHA-256: 7bc9ec1f0f651f44d55c29c2418a62c6073ac32e2c7b9aaefcfd115ed3f57211
objdata_02_off00028ce8.bin rtf-objdata-decoded RTF \objdata at offset 0x28CE8 482 bytes
SHA-256: 5335740b0cd34b41db1162eb5c2c304105d851714fd2d00522c05285a960dc0e
objdata_03_off000290e8.bin rtf-objdata-decoded RTF \objdata at offset 0x290E8 815 bytes
SHA-256: 715448127c85e8696ae7bc145be5f7c9fd53c9299e296ab30d9a6e529b53c2f9
objdata_04_off000297b7.bin rtf-objdata-decoded RTF \objdata at offset 0x297B7 2633 bytes
SHA-256: 1feb5f150bb35566d1a01fc59a357dc0ea34bc7498e0ec99bd939f6f848044b0
objdata_05_off0002acc4.bin rtf-objdata-decoded RTF \objdata at offset 0x2ACC4 4681 bytes
SHA-256: c4bb3f784feda536c3c8a254c5e4985ff95fb94510d6c6900c5e6ad04d5ce6fc
objdata_06_off0002d5bb.bin rtf-objdata-decoded RTF \objdata at offset 0x2D5BB 511692 bytes
SHA-256: c86cae6676c3fadf0e76b6af0011422594d5c5165f26d2819c0153130004126c
Detection
ClamAV: Win.Malware.Delf-6696577-0
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_MSF_REVERSE, SC_STR_VIRTUALALLOC, SC_STR_LOADLIBRARY Static shellcode analysis recovered API/import strings: LoadLibraryExA, VirtualAlloc, GetProcAddress, ExitProcess, VirtualProtect

Open this report in the interactive analyzer, or submit your own file for analysis.