Rtf.Dropper.Agent-7188392-0 — RTF malware analysis

Static analysis result for SHA-256 06ca3e27ac9ffd61…

MALICIOUS

RTF

223.3 KB First seen: 2020-02-04
MD5: ea476130c99076489bd564242fe80fa1 SHA-1: 4d9f5966dd305038a24d0734844140c87e9b4c19 SHA-256: 06ca3e27ac9ffd617b9546494a7dcd354180207a86017fa78c3895913bd60a61
320 Risk Score

Malware Insights

Rtf.Dropper.Agent-7188392-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple indicators of malicious activity, including OLE object data and composite monikers, specifically pointing to the CVE-2017-8570 vulnerability. This vulnerability is known to be used for dropping and executing script files, which is consistent with the ClamAV detection of 'Rtf.Dropper.Agent-7188392-0'. The presence of the 'SE_ENABLE_LURE' heuristic further suggests a user interaction is expected to trigger the payload.

Heuristics 9

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Rtf.Dropper.Agent-7188392-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7188392-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000531e.bin rtf-objdata-decoded RTF \objdata at offset 0x531E 9061 bytes
SHA-256: f2d46d646dc8b0dbfefed1fcc3dd5268698903392220d3aab015f62153d130fc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Sh"
objdata_01_off00009aed.bin rtf-objdata-decoded RTF \objdata at offset 0x9AED 12261 bytes
SHA-256: 010714f1a05164de42b9cf9db473155bac2155f3569c1db08838e973f2cd6269
objdata_02_off0000faff.bin rtf-objdata-decoded RTF \objdata at offset 0xFAFF 2632 bytes
SHA-256: cd422fad722349d22695a105a39c207bb6dc345f5ecfd1a9b29a77859048a591

Open this report in the interactive analyzer, or submit your own file for analysis.