RTF malware analysis — malicious · efcf77f46d05b1c0

MALICIOUS

RTF

687.4 KB Created: 2019-03-29 10:02:00 First seen: 2022-03-07

MD5: 7879d9e2c7f81964c5883f5dbf437847 SHA-1: 15ae8196488b6a1e4b1fa7b9d3b154c771d2a375 SHA-256: efcf77f46d05b1c00ccbfa2d4d85b591d2e6a68a8338f36761919a1cf7d82cf6

142 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1559.002 Component Object Model Hijacking T1059.001 PowerShell

The RTF file contains multiple OLE objects, with heuristics indicating that \objupdate forces OLE activation. The critical CVE-2017-8759 heuristic confirms the exploitation of MSXML SAX OLE activation. This suggests the file is designed to exploit this vulnerability to execute arbitrary code upon opening.

Heuristics 5

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 10 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml

Extracted artifacts 9

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00002cfb.bin` `a72fae859095859ab6da2959abab34f8effed95b62407e1e0cf88157b4abbf50`	rtf-objdata-decoded	RTF \objdata at offset 0x2CFB	22075 bytes
`objdata_01_off00012f94.bin` `5a271c51a984ae1ea27a129ce1b4f3f1b56369cd7861922b211d3168563da8e9`	rtf-objdata-decoded	RTF \objdata at offset 0x12F94	22075 bytes
`objdata_02_off0002322d.bin` `c09cd98d2b2fab242c9504b5bc937b29907519f429e32af0efc9388f0e49ad70`	rtf-objdata-decoded	RTF \objdata at offset 0x2322D	22075 bytes
`objdata_03_off000334c6.bin` `dcfd574c77274ac0a820c2df4576c413af13ed299b3fcb3f1fdf5b37f39d4660`	rtf-objdata-decoded	RTF \objdata at offset 0x334C6	22075 bytes
`objdata_05_off000539f8.bin` `403821ccd5513ebd1db5e24df1a0f78a8b0465aab09d7f7e82945bf8ecac19ce`	rtf-objdata-decoded	RTF \objdata at offset 0x539F8	22075 bytes
`objdata_06_off00063c91.bin` `bc60164bbda7eafe0bdeaf97affb263f05718245262512aa57614e6ae5169490`	rtf-objdata-decoded	RTF \objdata at offset 0x63C91	22075 bytes
`objdata_07_off00073f2a.bin` `88c2ed4fbf2bd2d6804617ed1028101c70233a05436bdd10d6760a3cccbe3ed1`	rtf-objdata-decoded	RTF \objdata at offset 0x73F2A	22075 bytes
`objdata_08_off000841c3.bin` `3efda550e731a260698fe0abea7e12d3aa641bc9cddced5eb4e9fe478815b616`	rtf-objdata-decoded	RTF \objdata at offset 0x841C3	22075 bytes
`objdata_09_off0009445c.bin` `c1a961373bffa1e0a9609690607467ab85e47914d79f04a34c59a8bd53923429`	rtf-objdata-decoded	RTF \objdata at offset 0x9445C	22075 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.