RTF malware analysis — malicious · 659043816a530625

MALICIOUS

RTF

378.5 KB First seen: 2019-03-10

MD5: 6987d2589510f4a057efb7115c67d041 SHA-1: 0158a09e6195ae1fec0bc5cdc89b4a78f148644e SHA-256: 659043816a530625141a648c9c1ffba6a731dc3b13ab1a5c05b8f9070cc36326

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document containing OLE objects and specifically triggers heuristics related to Equation Editor vulnerabilities, including CVE_2018_0802. The presence of ".objupdate" and the "ENABLE EDITING TEXT" lure indicate an attempt to activate embedded exploits. This suggests the document is designed to exploit a client-side vulnerability for code execution, likely delivered via spearphishing.

Heuristics 6

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000009c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x9C	464 bytes
SHA-256: `0df14213ca7d82dae8b4fe3328ca1ec119ac94e2ea80dae6374e619fe1fa8880`
`objdata_01_off0002e311.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2E311	4679 bytes
SHA-256: `f8bfb193f9f11cf441a5c8a68b651c15a4340c7d97594e6e042cd1be19f59f20`

Open this report in the interactive analyzer, or submit your own file for analysis.