This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.
This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.
This report contains information obtained from automated analysis and is not intended to be a complete description of the submitted sample. Results may be limited due to the complexity of the samples, or due to the ability of the samples to defend against automated analysis techniques. If additional information is required, please contact the Cybersecurity and Infrastructure Security Agency (CISA) using the information provided at the end of this report.
CISA received one artifact, ff4138ca9119ab0381ad6575f041e633, which appeared to be a crafted RTF document to perform penetration testing for the CVE-2012-0158 vulnerability found in Microsoft Office 2003, 2007 and 2010. It is actually an obfuscated RTF that when opened in Microsoft Word, it connected to nanocoatingindonesia.co.id and attempted to download an executable named Specification.exe, copied it over to word.scr and executed it immediately. At the time of this analysis, the domain returned HTTP 404 not found to the HTTP GET request.
For a downloadable copy of IOCs, see MIFR-10079683-1.v2.stix.
No matches found.
FF4138CA9119AB0381AD6575F041E633 is an obfuscated RTF document, appeared to be crafted to perform penetration testing when examined under a hexadecimal editor. Close to the end of file, ASCII data "For pentesting purposes only!" and the MD5 hash value of the RTF were found.
Figure 1 -
Figure 2 -
Figure 3 -