RTF malware analysis — malicious · 548218f5859af180

MALICIOUS

RTF

240.6 KB First seen: 2020-07-24

MD5: 0ca1ca3268a4eab2b1d2fea5df933f68 SHA-1: 79ae53a15c5e6855d97d5651b52b9673d4512ebf SHA-256: 548218f5859af180f8ac2a86097f09ecb31673e89a1ebe3fabf2fbae2fe59786

260 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains OLE object data and triggers heuristics related to CVE-2017-8570, indicating the exploitation of a composite moniker to drop embedded files. The presence of 'Script execution terms' and 'Shellcode command strings' within the extracted artifacts suggests that these dropped files are likely scripts or payloads intended for execution. The document body's content, consisting of various formatting styles rather than user-readable text, further supports a malicious intent rather than a legitimate document.

Heuristics 8

Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570

RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
OLE object data medium RTF_OBJDATA

RTF contains 3 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00005565.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5565	17591 bytes
SHA-256: `5b5722b9cc37e6b67e5dbfae0d13310fb477ee4af3b70c7e1aa309204dea73df`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered command string(s): Wscript.Shell" ) Carved artifact contains 2 shell/COM execution token(s).
`objdata_01_off0000dfd8.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xDFD8	12261 bytes
SHA-256: `3acc104551ed66a0b887faa2f93081783f78d431d81249e2c401c14e62aac774`
`objdata_02_off00013fea.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x13FEA	2632 bytes
SHA-256: `a483f12dcb6e4b0551213d4a635fd37957956b42b40e2fc9f057edbc2419eb50`

Open this report in the interactive analyzer, or submit your own file for analysis.