2

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?

  • I don't know answer for this but, I was developed a RTF parser for specific data set. You can also use context-specific expressions for your data. – de6f Dec 26 '17 at 8:43
2

It's difficult to say for sure since the tool is closed-source, but I suspect it means that the file contains extra data after the end of the document. For example, RTF usually begins with {\rtf1, contains many embedded commands (some using nested {} for parameters) and ends with a matching }. If there is extra data after the final }, it's not part of the document but could be part of the payload used by the exploit inside the main body. It is of course not a 100% indicator of a malicious file but just one of the possible hints that it should be checked more thoroughly.

To confirm, you can try running it on this sample RTF file from Wikipedia:

{\rtf1\ansi{\fonttbl\f0\fswiss Helvetica;}\f0\pard
This is some {\b bold} text.\par
}

Add some extra data at the end and see if it triggers the warning.

  • Good answer, “overlay” is a term from MSDOS days and used to mean exactly this. Malscan author is probably old :-) – manduca May 25 '18 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.