Reverse engineer malware embedded in Microsoft rtf

Question

I am currently trying to analyse a particular document that was flagged as malware in our honey pot.

In virus total is shows up as being a Trojan and I have reason to believe it might be connected to

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb

I am searching Google and seeing very little information on how I can go about diagnosing and reversing this. I want to see where it might be trying to connect back and what this is actually doing.

How can I go about reverse engineering malware embedded in a Windows rtf and see what this is designed to do ?

I can provide the malware if anyone wants.

Answer 1

Analysis often isn't worth it, unless your interest is academic don't spend too much time in analysing it. AV companies tend to use sandboxes and just monitor behaviour, that might be enough for you. Run the malware along with wireshark to see where it connects out to and block the C&C server IP address (as well as the domain the email was from and delete the message from all inboxes).

K, since that didn't answer your question, there seems to be a lot of research on the topic. A quick google for "extract rtf payload" gives a number of articles as well as some scripts to do it. Throw this in olly or ida and let the tracing begin.

O, and I hope your patching level was up to date :)