← All detection heuristics · RTF
high
RTF_PHP_IRC_BOT_SOURCE
What it means
RTF text contains PHP IRC bot source code.
Why it fires
The detector looks for a compound source-code pattern: PHP markers, socket connection calls, IRC protocol commands such as JOIN or PRIVMSG, and bot-control strings. The RTF is not necessarily an Office exploit, but it is carrying operational malware source code and should not be treated as a clean document.
Other RTF heuristics
RTF_EQUATION_EDITOR RTF_OBJCLASS_EQUATION RTF_MZ_HEX RTF_DDEAUTO_REGSVR32_SCRIPTLET RTF_MACOS_ZSH_LOADER RTF_PACKAGE_AUTOLINK_DELIVERY RTF_OBJAUTLINK RTF_INCLUDE_REMOTE RTF_EXCESSIVE_HEX RTF_PACKAGE_OLE RTF_OBFUSCATION RTF_OBJCLASS_PACKAGE RTF_REMOTE_TEMPLATE RTF_EXPLOIT_TEMPLATE_ARTIFACT RTF_OBJUPDATE_LOOSE_HEX_PAYLOAD RTF_OBJUPDATE RTF_PFRAGMENTS_RELATED RTF_OBJEMB RTF_WORD_COMPATIBILITY_PACKAGE RTF_OBJDATA RTF_OLEPRES_STREAM RTF_OLE10NATIVE_STREAM