Malicious RTF — malware analysis report

Static analysis result for SHA-256 05cefe581bd12fc2…

MALICIOUS

RTF

249.8 KB First seen: 2020-08-25
MD5: 28184903121e2b20adcc8ea7c7a8adcf SHA-1: 0254fc5d39ecf117fece2eec1ec32711170e201c SHA-256: 05cefe581bd12fc214bae1d713856c4cf6d9f9786427e3377af8607185288e46
240 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple indicators of exploitation, including OLE object data and composite moniker-related heuristics. Specifically, the CVE-2017-8570 heuristic indicates the file is designed to drop an SCT script, which is a common technique for executing arbitrary code. The embedded OLE objects and objdata sections further support this attack vector.

Heuristics 7

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000790.bin rtf-objdata-decoded RTF \objdata at offset 0x790 32281 bytes
SHA-256: 10597ccf569ff8edd2cdcabbdac1c46b63d1d859a3276667bb8299a18b652612
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell"" ) ")
objdata_01_off000104c7.bin rtf-objdata-decoded RTF \objdata at offset 0x104C7 12261 bytes
SHA-256: 12289ea42203fe86d5d6e86e52672f752ead5709842d0443203b40a4917d5ece
objdata_02_off000164d7.bin rtf-objdata-decoded RTF \objdata at offset 0x164D7 2632 bytes
SHA-256: ff4e9aaf9384b52652b79eaca517ccbf97d52846b4e013a0558d5ada8d82dc18

Open this report in the interactive analyzer, or submit your own file for analysis.