Malicious Office (OOXML) — malware analysis report

Heuristics 15

• Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
  (in altChunk RTF word/afchunk.rtf) Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
• CVE-2017-11882 — Equation Editor FONT record overflow critical CVE likely CVE_2017_11882
  (in altChunk RTF word/afchunk.rtf) Equation Editor MTEF contains an overlong FONT typeface field, the vulnerable copy primitive for CVE-2017-11882. This is stronger evidence than the Equation Editor CLSID alone because it identifies the malformed record that drives code execution in EQNEDT32.EXE.
• Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
  (in altChunk RTF word/afchunk.rtf) RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
• ClamAV: Doc.Dropper.Agent-6427474-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Dropper.Agent-6427474-0
• altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF
  Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
• PE header (with DOS stub) in hex data critical RTF_MZ_HEX
  (in altChunk RTF word/afchunk.rtf) Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
• altChunk RTF auto-updates embedded executable object critical OOXML_ALTCHUNK_RTF_AUTOUPDATE_PE
  OOXML document imports an embedded RTF through altChunk; the RTF contains OLE object data, forces object update, and carries a hex-encoded PE payload. This is a stronger compound exploit-loader shape than a generic altChunk RTF wrapper, but it is not tied to a single CVE unless the nested RTF object primitive also matches one.
• \objupdate forces OLE activation high RTF_OBJUPDATE
  (in altChunk RTF word/afchunk.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
• Package object class high RTF_OBJCLASS_PACKAGE
  (in altChunk RTF word/afchunk.rtf) OLE Package object — can wrap arbitrary files
• Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
  (in altChunk RTF word/afchunk.rtf) RTF contains ~2322KB of hex-encoded data inside \objdata sections — may hide a payload
• Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• OLE object data medium RTF_OBJDATA
  (in altChunk RTF word/afchunk.rtf) RTF contains 3 \objdata section(s) — embedded OLE objects
• Embedded OLE object medium RTF_OBJEMB
  (in altChunk RTF word/afchunk.rtf) RTF contains \objemb — embedded OLE object
• OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
  (in altChunk RTF word/afchunk.rtf) RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)

  • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/SMI/2005/WindowsSettingsIn document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.