How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
2
-
I don't know answer for this but, I was developed a RTF parser for specific data set. You can also use context-specific expressions for your data. – de6f Dec 26 '17 at 8:43
2
It's difficult to say for sure since the tool is closed-source, but I suspect it means that the file contains extra data after the end of the document. For example, RTF usually begins with {\rtf1, contains many embedded commands (some using nested {} for parameters) and ends with a matching }. If there is extra data after the final }, it's not part of the document but could be part of the payload used by the exploit inside the main body. It is of course not a 100% indicator of a malicious file but just one of the possible hints that it should be checked more thoroughly.
To confirm, you can try running it on this sample RTF file from Wikipedia:
{\rtf1\ansi{\fonttbl\f0\fswiss Helvetica;}\f0\pard
This is some {\b bold} text.\par
}
Add some extra data at the end and see if it triggers the warning.
answered Sep 25 '17 at 12:50
-
Good answer, “overlay” is a term from MSDOS days and used to mean exactly this. Malscan author is probably old :-) – manduca May 25 '18 at 4:09
