Malicious RTF — malware analysis report

Static analysis result for SHA-256 e9c2afa7baadaf55…

MALICIOUS

RTF

43.7 KB Created: 2017-11-27 12:54:00 First seen: 2017-12-08
MD5: 45915c02be84e870f060807a2bd27f49 SHA-1: 0eff0c4f6d9d67f757dd6a02b3ac5d1d21064b14 SHA-256: e9c2afa7baadaf55e3bb8607bfc58cbe6159e1fd18e0568429ee67a7fa84668a
182 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains OLE object data and is flagged for CVE-2017-8759, indicating exploitation of a SOAP Moniker vulnerability. This technique is commonly used to download and execute arbitrary code. The presence of an automatically linked OLE object further supports this attack vector. ClamAV also identifies the file as a downloader.

Heuristics 5

  • SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) critical CVE related CVE_2017_8759
    RTF \objdata decodes to OLE data containing the SOAP Moniker — CVE-2017-8759 (SOAP WSDL RCE) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • ClamAV: Rtf.Downloader.CVE_2017-6336326-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Downloader.CVE_2017-6336326-3
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000026e8.bin rtf-objdata-decoded RTF \objdata at offset 0x26E8 6956 bytes
SHA-256: 32b1d1d0b2b3f041d378a278ea786d2869d6dfa0481f5c492eeaf9bc83c80c38

Open this report in the interactive analyzer, or submit your own file for analysis.