RTF malware analysis — malicious · f815a03a1cfd34cd

MALICIOUS

RTF

224.0 KB Created: 2018-07-13 12:30:00 First seen: 2021-02-23

MD5: eeabc43299a4f24bb12652ec46912bcd SHA-1: 533dd65d2459b4f0415ca2a320be792b095ad257 SHA-256: f815a03a1cfd34cd3f01f63b2436d1c48b36decb4198dfd07f9156b86176d58e

242 Risk Score

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003c2a.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C2A	24635 bytes
SHA-256: `bfdd071c38a92731e25373930991739f76e9b22de250437b7ee097718bb4e10c`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_01_off0001546c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1546C	24635 bytes
SHA-256: `4857170be09e92f0a5cfe1536d0714cc2c40a9a3257ec8591800304b6a753fb1`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_02_off00026cae.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x26CAE	24635 bytes
SHA-256: `432c6cc10f4e3271384f964a2a7d2efba5d6a719349ed996bec265fe5bf419b0`
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.