RTF malware analysis — malicious · 3cd726bb28874e42

MALICIOUS

RTF

378.5 KB First seen: 2020-01-07

MD5: aff325b29b1a26a440d73b78cc49a29d SHA-1: 04dc8a4934465a4e2de43b046602990c908fdc6b SHA-256: 3cd726bb28874e424e3567e0ea23bf48a4d2aee6b55ca05bd53eb1c90535483c

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document containing OLE objects and specifically triggers heuristics related to Equation Editor vulnerabilities, including CVE_2018_0802. The presence of ".objupdate" and the "ENABLE EDITING TEXT" lure indicate an attempt to activate embedded exploits. This suggests the document is designed to exploit a client-side vulnerability for code execution, likely delivered via spearphishing.

Heuristics 6

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000009c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x9C	464 bytes
SHA-256: `61194167d6f71eec0454577aaf886c75312beadb4aeef9c95962d0e595bff743`
`objdata_01_off0002e311.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2E311	4679 bytes
SHA-256: `f8bfb193f9f11cf441a5c8a68b651c15a4340c7d97594e6e042cd1be19f59f20`

Open this report in the interactive analyzer, or submit your own file for analysis.