0

I am currently trying to analyse a particular document that was flagged as malware in our honey pot.

In virus total is shows up as being a Trojan and I have reason to believe it might be connected to

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb

I am searching Google and seeing very little information on how I can go about diagnosing and reversing this. I want to see where it might be trying to connect back and what this is actually doing.

How can I go about reverse engineering malware embedded in a Windows rtf and see what this is designed to do ?

I can provide the malware if anyone wants.

  • Why was this marked down without a comment? – Qndel Aug 1 '15 at 14:17
1

Analysis often isn't worth it, unless your interest is academic don't spend too much time in analysing it. AV companies tend to use sandboxes and just monitor behaviour, that might be enough for you. Run the malware along with wireshark to see where it connects out to and block the C&C server IP address (as well as the domain the email was from and delete the message from all inboxes).

K, since that didn't answer your question, there seems to be a lot of research on the topic. A quick google for "extract rtf payload" gives a number of articles as well as some scripts to do it. Throw this in olly or ida and let the tracing begin.

O, and I hope your patching level was up to date :)

  • The google search would have sufficed, but thanks for being verbose! – Qndel Aug 1 '15 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.