Doc.Dropper.Agent-6934231-0 — RTF malware analysis

Static analysis result for SHA-256 fa5ce880e56b4fe5…

MALICIOUS

RTF

708.1 KB Created: 2018-04-21 20:51:00 First seen: 2019-04-18
MD5: 35668d4e0b695960ea55263ed4e62533 SHA-1: 20dfd58b4f45efc773422a5d03dfd2be02fc5f16 SHA-256: fa5ce880e56b4fe51a8305319dddf16d21de8b2154a4eac0b318b42c781e46dc
202 Risk Score

Malware Insights

Doc.Dropper.Agent-6934231-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects and triggers an OLE activation via \objupdate, which is a strong indicator of exploitation. The critical heuristic firing for CVE-2017-8759 confirms the exploitation of this specific vulnerability in MSXML SAX for OLE activation. This technique is commonly used by droppers to download and execute further malicious stages.

Heuristics 6

  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • ClamAV: Doc.Dropper.Agent-6934231-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6934231-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 10 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002c47.bin rtf-objdata-decoded RTF \objdata at offset 0x2C47 21051 bytes
SHA-256: 4d23ef90fd060b743b25cd252f1be2afce59cbb04b06efe188a8e72ed3a89503
objdata_01_off00012b64.bin rtf-objdata-decoded RTF \objdata at offset 0x12B64 21051 bytes
SHA-256: dd53524321104ebd5d0affc3732256c001b90c7bdd8b3014c1a20dd50430723e
objdata_02_off00022acf.bin rtf-objdata-decoded RTF \objdata at offset 0x22ACF 21051 bytes
SHA-256: 8377830b4e6edbf703fb18193025b2fe100306adaa4953fc5ebd37dc61fbbfd5
objdata_03_off00032a3a.bin rtf-objdata-decoded RTF \objdata at offset 0x32A3A 21051 bytes
SHA-256: 285bdfe76056908cc160995e475dcc178b0fb17bcca58626e57e5fe3f88923bb
objdata_04_off000429a5.bin rtf-objdata-decoded RTF \objdata at offset 0x429A5 21051 bytes
SHA-256: 685688c0ccae6a9025c4ba8a1a7adedbedf71c5c354bf372f326c549302db803
objdata_05_off00052917.bin rtf-objdata-decoded RTF \objdata at offset 0x52917 21051 bytes
SHA-256: 98c346c7e4b83007448c5fb9a0bdec91da2aa1abf4f24c7322fcdd739b5fda5d
objdata_06_off00062834.bin rtf-objdata-decoded RTF \objdata at offset 0x62834 21051 bytes
SHA-256: cfe005726afcc73c47a08b32f68c2400f7dc2252d659e32ee39d6e9a04112e08
objdata_07_off0007279f.bin rtf-objdata-decoded RTF \objdata at offset 0x7279F 21051 bytes
SHA-256: 7ad892f47ffa04b979185326bf33a017c0679e037cbf9ead83090971d763a633
objdata_08_off0008270a.bin rtf-objdata-decoded RTF \objdata at offset 0x8270A 21051 bytes
SHA-256: e96ba7f87515aa6df65dcda9ce1b0d94d919219619fbb9bb942857310291c23b
objdata_09_off00092675.bin rtf-objdata-decoded RTF \objdata at offset 0x92675 21051 bytes
SHA-256: 1c8f01f8ab9f3b22af288e70736e77f156b7a4529d33315ac2cfb207439a29b2

Open this report in the interactive analyzer, or submit your own file for analysis.