Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 82d687b835b9cd13…

MALICIOUS

RTF / .DOC

318.6 KB Created: 2020-05-22 09:52:00
MD5: 31c7076fd76b6f82bb957570dcb2a7c4 SHA-1: 1ed3e2df5b16cbcd1f96e50d10b9876001c6fafd SHA-256: 82d687b835b9cd13408495c0e3979aad732f6dee11fcfddff3d1921af22fc9e0
148 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains multiple OLE objects, with heuristics indicating that \objupdate forces OLE activation and that a Composite Moniker is present. The document body mimics a payment confirmation from DBS, suggesting a lure to trick the user into interacting with the embedded object. The presence of OLE objects and the invoice-like content strongly suggest an attempt to execute embedded code, likely for payload delivery.

Heuristics 7

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml
    • https://ideal3ng.dbs.com/s1gcb/sbb/gbs/landing
    • https://ideal3ng.dbs.com/s1gcb/sbb/gbs/landing#}}}\sectd

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000eee8.bin
cda628448ba4ac6a23a428f7b3deecf4f4abed3e0eb00ace2f125543aa5b0e66		 rtf-objdata-decoded RTF \objdata at offset 0xEEE8 37899 bytes
objdata_01_off00021803.bin
12289ea42203fe86d5d6e86e52672f752ead5709842d0443203b40a4917d5ece		 rtf-objdata-decoded RTF \objdata at offset 0x21803 12261 bytes
objdata_02_off00027813.bin
85d6091446d36ace1a64d60e026533f555a6b0e68ed3a849a4e8a705f29415d4		 rtf-objdata-decoded RTF \objdata at offset 0x27813 2632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.