Malicious RTF — malware analysis report

Static analysis result for SHA-256 e296104c0eba0abc…

MALICIOUS

RTF

787.5 KB Created: 2018-04-18 01:37:00 First seen: 2018-04-30
MD5: 77a3cf2c922c0def35fca4d4ace786fe SHA-1: 4e849a761e8c448b0d3b43e71664288816c133a1 SHA-256: e296104c0eba0abc17a161c8b5e9f5dd7c3adf98f0d6bed150706c2095b36741
142 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an OLE activation via \objupdate, which is a strong indicator of exploitation. The critical heuristic firing for CVE-2017-8759 confirms the exploitation of this specific vulnerability to achieve code execution. The embedded benign URL is not considered a malicious IOC.

Heuristics 5

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c16.bin rtf-objdata-decoded RTF \objdata at offset 0x2C16 26683 bytes
SHA-256: 26994165048cdbcd35cc416ebeba63db051c08b5907c6883562d75351865a2af
objdata_01_off000156c4.bin rtf-objdata-decoded RTF \objdata at offset 0x156C4 26683 bytes
SHA-256: 152dca0d192def210989f01e941369f2ad94c81e6597432ca5915022959b8b96
objdata_02_off00028172.bin rtf-objdata-decoded RTF \objdata at offset 0x28172 26683 bytes
SHA-256: 023bef8e96a30f55231be09be82059ed5efc8f8fcde344b0c5f9994c56d55c76
objdata_03_off0003ac20.bin rtf-objdata-decoded RTF \objdata at offset 0x3AC20 26683 bytes
SHA-256: 02818b33bbda08cb8cb3bc3e660042efbab79d45503d22ef352d20f561ef27d8
objdata_04_off0004d6ce.bin rtf-objdata-decoded RTF \objdata at offset 0x4D6CE 26683 bytes
SHA-256: 39fe85f6ec8574b039bf3134c15a41272f2c5138f76292f1f5f6b5ee20558fa0
objdata_05_off000601c6.bin rtf-objdata-decoded RTF \objdata at offset 0x601C6 26683 bytes
SHA-256: 22bdd88383b2ebd0b1779340eb669699f670d8288f827141ea9a4b038e5adadf
objdata_06_off00072c74.bin rtf-objdata-decoded RTF \objdata at offset 0x72C74 26683 bytes
SHA-256: 8c1a42e1b9151b116259b7fa16bb4f55864379665993ce96d6cf41bba9429c3c
objdata_07_off00085722.bin rtf-objdata-decoded RTF \objdata at offset 0x85722 26683 bytes
SHA-256: d3f4079a868c9c19f760f5687b4522ea30ae0dc83324f61345d491d4ca11f565
objdata_08_off000981d0.bin rtf-objdata-decoded RTF \objdata at offset 0x981D0 26683 bytes
SHA-256: e6db17092e8e34b59049ebc950cf106e3a94cc1fc1687e25d9b4bbf25ce7db15
objdata_09_off000aac7e.bin rtf-objdata-decoded RTF \objdata at offset 0xAAC7E 26683 bytes
SHA-256: 0df2e94b152b192ae6d4a7b6d0f092bba211665ccd319a892e1dbb3a53379386

Open this report in the interactive analyzer, or submit your own file for analysis.