RTF malware analysis — malicious · edc06476c3e8a14b

MALICIOUS

RTF

464.0 KB Created: 2018-07-13 13:10:00 First seen: 2021-02-23

MD5: 04d8a53865eab1aa5ca5c28f3d801d06 SHA-1: 1cc1407361248cef25731b83c32831ffbe203576 SHA-256: edc06476c3e8a14bb37b750382295f40791fa66dba982613856016cf79006edd

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 7 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c2c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C2C	24635 bytes
SHA-256: `fd5530cd3dd49bdb8c3037ab194bc4aa17acb12283b75d03f9ad9c56a32f37a0`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off0001546e.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1546E	24635 bytes
SHA-256: `2a42e221f12c036052ebf4ab51758cc64ecf7d5f0044df97a853018eb11ebbba`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026cb0.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CB0	24635 bytes
SHA-256: `21ab6c38e76ff2469d21d4910a0025ab5c07e58dd0c3d330fb63e9730b8f5b9c`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_03_off000384f2.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x384F2	24635 bytes
SHA-256: `5ca6cf94ab1faeee5bdb66e818387d4ee2c822495d014c17113d39c8b44533de`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_04_off00049d34.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x49D34	24635 bytes
SHA-256: `5fada3da7721e3fe02399a11de38bdcce7ad3234109563e7884c7d7753a725b7`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_05_off0005c386.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5C386	24635 bytes
SHA-256: `7e57c694a6cabd33ac76c61151ae979517183c9864b420f78ed004a41c7e5660`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_06_off0006dbe7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x6DBE7	12710 bytes
SHA-256: `eb72d53db720a4280a4389282f9d2445fb3f962c28a99987e533cc2722c687ef`

Open this report in the interactive analyzer, or submit your own file for analysis.