RTF malware analysis — malicious · 6ad3d30b628536b8

MALICIOUS

RTF

250.6 KB Authoring application: Riched20 10.0.15063

MD5: 206e37893ce21ada9f617d376980f893 SHA-1: c9879e1c13cffd4a78e7c1f2f69ef3a1c0e84e04 SHA-256: 6ad3d30b628536b83364e29c4e91d207d162440ff7796e12c2a55b388cf30ee8

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains multiple embedded OLE objects, indicated by RTF_OBJDATA and RTF_OBJEMB heuristics. The presence of RTF_OBJUPDATE suggests that these objects are intended to be activated, which is a common technique for executing embedded exploits or payloads. Without further analysis of the OLE object contents, the specific family remains unknown.

Heuristics 4

\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000010d.bin` `d21c758c8cedc0d38e5a1aeedb37c0b6765bf4f73468b562e6a6ee9cf34775a9`	rtf-objdata-decoded	RTF \objdata at offset 0x10D	24910 bytes
`objdata_01_off0000c95c.bin` `bbd38d65f4c3c6f83ba5f2fcfc9a48941ec922d399eb03e98f3f29f595f7da33`	rtf-objdata-decoded	RTF \objdata at offset 0xC95C	24910 bytes
`objdata_02_off000191ab.bin` `356da2fa58e5fc1c7980d0c070000507df25460310a16a34e650e6751bed5661`	rtf-objdata-decoded	RTF \objdata at offset 0x191AB	24910 bytes
`objdata_03_off000259fa.bin` `555fe445f4ab054ece3192025c574c7820d2f0fdd09e87c24e805507e40baaa0`	rtf-objdata-decoded	RTF \objdata at offset 0x259FA	24910 bytes
`objdata_04_off00032249.bin` `a7a5f9d3fb512b71950b78a1f44faf0e598501f749f841c99d32af50d0ce2c74`	rtf-objdata-decoded	RTF \objdata at offset 0x32249	24910 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.