How Malformed RTF Defeats Security Engines

ronjor · Mar 23, 2017

Talos Group - March 23, 2017

This post is authored by Paul Rascagneres with contributions from Alex McDonnell
Executive Summary

Talos has discovered a new spam campaign used to infect targets with the well known Loki Bot stealer.
Click to expand...

guest · Jan 22, 2019

Fake Quotation Request with malformed RTF file attachments delivering Lokibot
January 22, 2019
https://myonlinesecurity.co.uk/fake...rmed-rtf-file-attachments-delivering-lokibot/

Another day and yet another malformed. malicious word doc attachment that is a renamed RTF file delivering Lokibot malware. These criminal gangs are really playing around with RTF files and constantly changing the header control word to try to bypass Anti-Virus & Next Gen protection.
Today’s version is using a {\rtv0 header which isn’t of course any approved header, but Microsoft Office Word will open anything that starts with {\rt and just about ignores the rest of the control word.

There is some dispute which Equation editor exploit is involved in this campaign. Anyrun says CVE-2017-11882, whereas various detections on Virustotal say either just heuristic office detection or even CVE-2012-0158. It probably is CVE-2017-11882 but it might just be a new exploit using similar methods.

This email attachment contains what appears to be a genuine word doc containing an embedded OLE object that when run will infect you.
Modern versions of Microsoft office, that is Office 2010, 2013, 2016 and Office 365 should be automatically set to higher security to protect you. [...] Do NOT enable Macros or editing under any circumstances.
Click to expand...

Log in or Sign up

How Malformed RTF Defeats Security Engines

ronjor Global Moderator

guest Guest

Log in or Sign up

How Malformed RTF Defeats Security Engines

ronjor Global Moderator

guest Guest

Useful Searches