Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight.
I know that many exploits use this for loading the msvcr71.dll (non-ASLR module).
My suspicion is the file I'm working with is malicious. Does this have any good use inside a office file or is just plain malicious?
Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion.
otkloadr.dll is a library used for Visual Studio / office integration, as part of a package called "Microsoft Visual Studio Tools for the Microsoft Office System".
That package is used to incorporate Visual Studio components inside Office documents (such as rtf files), and to generate/manipulate Office files programmatically from within Microsoft development environments.
It might be used in an rtf document generated automatically directly by Microsoft-provided development tools or by a third party tool using Microsoft's office integration library (most third party office related manipulation tools are using this internally, and usually simply provide a different interface, probably in a different programming language).
It might also be used in an rtf using one of the advanced features "Microsoft Visual Studio Tools for the Microsoft Office System" brought into Office, or was converted from a newer format that did.
Inspecting the file format is needed to reach these conclusions with a higher degree of certainty. Since RTF is as mentioned a textual format this shouldn't be too complicated. Additionally, googling for RTF file parser yields multiple promising results.
