Malicious RTF — malware analysis report

Heuristics 9

• Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
  Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
• Equation Editor activation — CVE-2017-11882 related high CVE related CVE_2017_11882_ACTIVATION_RELATED
  RTF decodes to an Equation.3 ProgID and requests OLE activation with \objemb plus \objupdate. This reaches the legacy Equation Editor attack surface used by CVE-2017-11882/CVE-2018-0802 documents, but the malformed MTEF/native payload needed for stronger attribution was not recovered.
• ClamAV: Rtf.Dropper.Agent-9965975-1 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Rtf.Dropper.Agent-9965975-1
• Equation Editor object class critical RTF_OBJCLASS_EQUATION
  Object class 'equation.3' references Equation Editor
• PE header (with DOS stub) in hex data critical RTF_MZ_HEX
  Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
• \objupdate forces OLE activation high RTF_OBJUPDATE
  RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
• OLE object data medium RTF_OBJDATA
  RTF contains 1 \objdata section(s) — embedded OLE objects
• Embedded OLE object medium RTF_OBJEMB
  RTF contains \objemb — embedded OLE object
• OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
  RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Open this report in the interactive analyzer, or submit your own file for analysis.