RTF detection heuristics

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID (0002CE02) found in RTF hex data.

Equation Editor object class critical RTF_OBJCLASS_EQUATION

Object class name references Equation Editor.

PE header in hex data critical RTF_MZ_HEX

MZ header (hex '4D5A') found in RTF hex data.

RTF DDEAUTO launches a remote regsvr32 scriptlet critical RTF_DDEAUTO_REGSVR32_SCRIPTLET

An RTF DDEAUTO field launches cmd and regsvr32 with scrobj.dll.

RTF body contains macOS zsh loader critical RTF_MACOS_ZSH_LOADER

Visible RTF text contains a base64/gzip shell loader executed with zsh.

Automatically activated RTF Package/OLE delivery high RTF_PACKAGE_AUTOLINK_DELIVERY

An RTF Package or Word OLE object is paired with objautlink/objupdate activation.

Automatically linked OLE object high RTF_OBJAUTLINK

RTF contains \objautlink — an automatically linked OLE object marker.

INCLUDETEXT/INCLUDEPICTURE remote URL high RTF_INCLUDE_REMOTE

RTF document uses INCLUDETEXT or INCLUDEPICTURE with an http:// or https:// URL.

Large hex data blocks high RTF_EXCESSIVE_HEX

RTF contains large blocks of hex-encoded data.

OLE Package CLSID high RTF_PACKAGE_OLE

OLE Package CLSID pattern found alongside object data.

Obfuscated control words high RTF_OBFUSCATION

Many RTF control words appear fragmented or obfuscated.

PHP IRC bot source embedded in RTF high RTF_PHP_IRC_BOT_SOURCE

RTF text contains PHP IRC bot source code.

Package object class high RTF_OBJCLASS_PACKAGE

OLE Package object found in RTF.

Remote template injection (\*\template to remote URL) high RTF_REMOTE_TEMPLATE

The RTF's \*\template destination is a remote URL/UNC path that Word fetches and loads on open.

Uninstantiated RTF/Flash exploit-builder template high RTF_EXPLOIT_TEMPLATE_ARTIFACT

RTF contains public exploit-builder placeholders around a Flash ActiveX object.

\objupdate activation with payload hidden outside \objdata high RTF_OBJUPDATE_LOOSE_HEX_PAYLOAD

RTF declares an auto-activating OLE object (\objupdate) but stores its payload as a large loose hex region outside any \objdata destination.

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object activation.

\pFragments control word high RTF_PFRAGMENTS_RELATED

RTF contains \pFragments without the oversized value needed for CVE-2010-3333.

Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — an embedded OLE object marker.

Embedded Word compatibility/frame package in RTF medium RTF_WORD_COMPATIBILITY_PACKAGE

RTF contains a hidden Word compatibility or frame relationship package.

OLE object data medium RTF_OBJDATA

RTF contains \objdata sections with embedded OLE objects.

OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF embedded OLE object contains an OlePres presentation stream marker.

RTF OLE10Native Stream medium RTF_OLE10NATIVE_STREAM

RTF embedded object evidence: RTF OLE10Native Stream.