Personal WebsiteGithubLinkedIn

Emprisa Maldoc

Always open malware in a secure environment like a VM.

We will be using the REMnux distribution which is specifically made for reverse engineering.

Q1. What is the CVE ID of the exploited vulnerability?

Let's find the file hash using md5sum.

$ md5sum c39-EmprisaMaldoc.rtf 
d82341600606afcf027646ea42f285ae  c39-EmprisaMaldoc.rtf

We can search the file hash or just open the file in VirusTotal in order to find the CVE ID.

Answer

Q2. To reproduce the exploit in a lab environment and mimic a corporate machine running Microsoft office 2007, a specific patch should not be installed. Provide the patch number.

Microsoft released a patch in 2017 for this vulnerability.

  • We can see the patch number mentioned in Method 3.

Q3. What is the magic signature in the object data?

  • The rtfdump tool help with this task.

Q4. What is the name of the spawned process when the document gets opened?

  • On opening the file with Any.Run, we can see that there is EQNEDT32.EXE process.

  • This process makes connections with a Github account which is malicious behaviour.

Q5. What is the full path of the downloaded payload?

Q6. Where is the URL used to fetch the payload?

  • The answer is present in the final line of the last command output.

Q7. What is the flag inside the payload?

  • Let's download the file from the URL we found for the previous question. We can use wget or curl for this task.

  • Then we can grep for the word flag piped with the strings command.

Last updated

Was this helpful?