MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1559.002 Component Object Model
T1204.002 Malicious File
The RTF document contains multiple OLE objects, with specific heuristics indicating the use of ".objdata" sections and a Composite Moniker. The "\objupdate" directive suggests that these objects are designed to be activated automatically upon opening the document, likely to exploit a vulnerability and execute embedded code. No document body text or scripts were extracted, limiting further analysis of the specific payload.
Heuristics 5
-
Composite Moniker in RTF OLE object high RTF_COMPOSITE_MONIKER_RELATEDRTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
-
\objupdate forces OLE activation high RTF_OBJUPDATERTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
-
OLE object data medium RTF_OBJDATARTF contains 3 \objdata section(s) — embedded OLE objects
-
Embedded OLE object medium RTF_OBJEMBRTF contains \objemb — embedded OLE object
-
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAMRTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
objdata_00_off00000800.binca88c95aafcbe05e35b1766d6cfcf153621762ad70d50222f2788376ce11418c |
rtf-objdata-decoded | RTF \objdata at offset 0x800 | 12901 bytes |
objdata_01_off00006d42.binefcad781cab3d633c5a53c0b86b2c30761dd037463d8eb36ded19f59f1126d89 |
rtf-objdata-decoded | RTF \objdata at offset 0x6D42 | 2632 bytes |
objdata_02_off000082dd.bincfdf79b95584afe599f8bd01e391d8904839d9495e407a353433d3f5e3be3602 |
rtf-objdata-decoded | RTF \objdata at offset 0x82DD | 12261 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.