Malicious RTF — malware analysis report

Static analysis result for SHA-256 f9034c82874af5ef…

MALICIOUS

RTF

841.3 KB Created: 2018-03-12 22:12:00 First seen: 2018-06-14
MD5: 3550099425b5c16cc1e500d133e4695d SHA-1: 6e0978d1d4fd223f9d551abef809270fb08c360a SHA-256: f9034c82874af5efb6f323128b712736c0745c8e30de168db688d0d5c748be8b
262 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an ".objupdate" command, which is indicative of exploiting vulnerabilities like CVE-2017-8759 for client execution. ClamAV detections further confirm its malicious nature, flagging it as Doc.Macro.Obfuscation. The primary attack vector is likely spearphishing attachment, with the embedded OLE object serving as the mechanism to download and execute a secondary payload.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Xls.Downloader.Generic-6750544-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Generic-6750544-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c4d.bin rtf-objdata-decoded RTF \objdata at offset 0x2C4D 28731 bytes
SHA-256: 4c1c8dbeccf09fe9ec3f326d5c47d90deae3e50109d2839d5de721dab9b61cb2
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_01_off00016c8e.bin rtf-objdata-decoded RTF \objdata at offset 0x16C8E 28731 bytes
SHA-256: 413ff4fae98b506acd71e85d4b687257bf750fdf5f1608f07893c838ded5bf98
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_02_off0002accf.bin rtf-objdata-decoded RTF \objdata at offset 0x2ACCF 28731 bytes
SHA-256: 5c4aeb605d1ad238561d8dd30e9ed9614cf9eb2cd6146f242f57461cc484f44f
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_04_off00052d51.bin rtf-objdata-decoded RTF \objdata at offset 0x52D51 28731 bytes
SHA-256: e087057487abb49bb2e707254af0740e83561be925545d8225f0cd12ff143bee
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_06_off0007add3.bin rtf-objdata-decoded RTF \objdata at offset 0x7ADD3 28731 bytes
SHA-256: 6d107f98c42ac10e0c697c7acd3059e3374a3ebbec24641e2bdfe1ba3a9001fd
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_08_off000a2e55.bin rtf-objdata-decoded RTF \objdata at offset 0xA2E55 28731 bytes
SHA-256: bf248d0be3d883a54be613bd2649100298d2db64835e88d370e984738f1614fa
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely
objdata_09_off000b6e96.bin rtf-objdata-decoded RTF \objdata at offset 0xB6E96 28731 bytes
SHA-256: e002cdf38eab3476ce439b66fd33004a11cb096b679d70627bebceb2fcd04faf
Detection
ClamAV: Xls.Downloader.Generic-6750544-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.