RTF malware analysis — malicious · 13792bf621c7f0c5

MALICIOUS

RTF

107.0 KB First seen: 2025-08-01

MD5: eab0fdd0b9b371656554ca61916a0ff7 SHA-1: 09a6cf86b7fa397bcfe21ecdacdb2230b4d11c9c SHA-256: 13792bf621c7f0c52e858b58821677cb3b3ddf5154cbc5399a5187d1e2b5ddd6

120 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.001 PowerShell

The RTF file contains an embedded OLE object that triggers an Equation Editor vulnerability, as indicated by the RTF_EQUATION_EDITOR and RTF_OBJUPDATE heuristics. This exploit is designed to execute code, likely to download and run a secondary payload. The specific exploit mechanism points to a common method for initial compromise.

Heuristics 3

Equation Editor CLSID critical RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00001f99.bin` `d7b525a52122fcf86bcde19c03d550b8e4914f404305018096e717a8e1de3250`	rtf-objdata-decoded	RTF \objdata at offset 0x1F99	4743 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.