RTF / .DOC malware analysis — malicious · 48731a407c161307

MALICIOUS

RTF / .DOC

213.3 KB

MD5: 5410ea9a79d9b86deb7fc68b2c0c9c85 SHA-1: 4b62655ed52d8bba1937b565ea8fffd449d1818e SHA-256: 48731a407c161307c2725f94644a1ac4f1fe9ee7b08e83d13eadb629aa434052

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204 User Execution: Malicious Link T1566.001 Phishing: Spearphishing Attachment T1059.005 Exploitation for Client Execution: Visual Basic

The RTF document contains multiple OLE objects, including embedded objects and object data. The presence of `RTF_OBJUPDATE` and `RTF_COMPOSITE_MONIKER_RELATED` heuristics indicates that the document attempts to activate these objects, likely to execute embedded code. The `SE_ENABLE_LURE` heuristic confirms that the document prompts the user to enable editing, a common social engineering tactic to bypass security measures and execute malicious payloads.

Heuristics 6

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000bd0.bin` `baa03141950020f39c891851ab4640632f347c9ac0c8321bf7982826eae7d7bf`	rtf-objdata-decoded	RTF \objdata at offset 0xBD0	12892 bytes
`objdata_01_off0000722d.bin` `0d5d09fb7e87d140659b8f662dc3a7b92cd848450a431d1974047996c57d1f01`	rtf-objdata-decoded	RTF \objdata at offset 0x722D	2632 bytes
`objdata_02_off000087c8.bin` `cfdf79b95584afe599f8bd01e391d8904839d9495e407a353433d3f5e3be3602`	rtf-objdata-decoded	RTF \objdata at offset 0x87C8	12261 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.