Avoid detection of RTF as CVE-2017-0199

[honeyfairy]

The RTF files are being detected as CVE-2017-0199, any pointers or ideas on what we could do to avoid the rtf file being detected as CVE-2017-0199?

[DanusMinimus]

What product is showing the alert?

[honeyfairy]

Trend micro antivirus and Avast. Also gmail and other mail scanners.

[chvancooten]

Hey, AV evasion is explicitly not provided as part of this repo (and hard to maintain since it is open source). I'll keep this issue open for discussion though.

[honeyfairy]

Hey, AV evasion is explicitly not provided as part of this repo (and hard to maintain since it is open source). I'll keep this issue open for discussion though.

Thank you for keeping it open. It is currently being incorrectly detected as a different CVE.

[DanusMinimus]

From what I saw oletools detects this as possible CVE-2017-0199. I guess since it detects the URLMoniker and the OLE2Link class name with the RTF.