I've received lately a .rtf attachment on my work email from an untrusted email account.
I suspect the attacker is exploiting "Microsoft Security Bulletin MS12-029" vulnerability.
What are the recommended steps to study this .rtf file and learn the attack used in it?
A cursory look at the Web yields no precise detail, but it seems (from what is said on this page) that the vulnerability is one of the usual suspects: buffer overflow (probably on the heap, not on the stack) or access-after-free.
Among possible analysis methods:
Setup two virtual machines, with external accesses properly filtered; the two machines should differ only by the version of Office they contain (one patched, one unpatched). Take snapshots of both. Record the hashes of all files on both machines. Open the file in both, while recording every attempt at external traffic. Afterwards, see what changed on both machines (recompute all file hashes, compare with previous lists, use the snapshots to see what exactly changed in each file).
Open the RTF file with a binary editor (or a text editor such as vim, not an editor which will try to interpret the RTF file). Decode "mentally" the file with the help of the RTF specification. Think very hard. An overflow exploit would probably appear in the RTF file as a funky-looking structure with overlong weird identifiers or inordinate nesting.
Contact Microsoft and ask for details. This method works better if you are a government official from a big enough country, or you are very rich, or both.
