GIAC
GREM · Question #98
You are analyzing a suspicious RTF file that is suspected of exploiting a buffer overflow vulnerability. The file contains multiple embedded OLE objects, and the content appears obfuscated. How…
The correct answer is A. Use a tool like RTFScan to detect and extract any embedded shellcode. B. Open the file in a hex editor and look for suspicious patterns in the OLE objects. D. Analyze the file for any exploit patterns related to CVE-2017-0199 or similar vulnerabilities. See the full explanation below for the reasoning.
Question
You are analyzing a suspicious RTF file that is suspected of exploiting a buffer overflow vulnerability. The file contains multiple embedded OLE objects, and the content appears obfuscated. How would you proceed with the analysis? (Choose three)
Options
- AUse a tool like RTFScan to detect and extract any embedded shellcode.
- BOpen the file in a hex editor and look for suspicious patterns in the OLE objects.
- CExecute the RTF file to observe any unusual system behavior.
- DAnalyze the file for any exploit patterns related to CVE-2017-0199 or similar vulnerabilities.
- EConvert the file to plaintext and examine it for anomalies.
How the community answered
(55 responses)- A73% (40)
- C7% (4)
- E20% (11)
Community Discussion
No community discussion yet for this question.