RTF malware analysis — malicious · 3faacef20002f9de

MALICIOUS

RTF

916.1 KB Created: 2017-05-22 11:52:00 Authoring application: Micro soft Word 11.0.5604 First seen: 2019-05-31

MD5: f91e939f2c6cdb4383050edf9d5cd58c SHA-1: dd4648aae5b046971b1db73a50ab165a776025e8 SHA-256: 3faacef20002f9deb1305c43ea75b8422fd29a1559c0cf01cf1cee6a1b94fc0e

122 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document that contains OLE object data and triggers a high-severity heuristic for CVE-2012-0158, indicating exploitation of a vulnerability in MSCOMCTL.ListView. This suggests the file is designed to execute arbitrary code when opened, likely delivered as a spearphishing attachment. No specific malware family could be identified.

Heuristics 5

MSCOMCTL.ListView — CVE-2012-0158 high CVE related CVE_2012_0158

RTF \objdata decodes to OLE data containing the MSCOMCTL.ListView — CVE-2012-0158 CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main In RTF body
- http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0003bff9.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3BFF9	440 bytes
SHA-256: `ea5d234f81e7c6f4d2681a1e14ba35656c4caea1ff0358220f369a5f5b5ba6da`
`objdata_01_off0003c3e1.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3C3E1	8894 bytes
SHA-256: `8e6aa36643fd7842b8a4640e945f09f468b724f6ccbe048f58f75685d133fe6c`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\11.0\Word\Resiliency" /F
`objdata_02_off0003e775.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x3E775	2361 bytes
SHA-256: `01b5c1107f9bf512b7dbea22d48eef58e0f38766928ea70c2461238f8566efc7`
`objdata_03_off00045f41.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x45F41	167010 bytes
SHA-256: `d87a516edbc8fe96134611ba592a38b2a447d7502f19e04a63d468bc09527571`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact entropy is 7.54, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.