Office (OOXML) / .DOCX malware analysis — malicious · 8faf7709170f5c93

MALICIOUS

Office (OOXML) / .DOCX

223.3 KB Created: 2021-04-18 19:39:00 UTC Authoring application: Microsoft Office Word 16.0000

MD5: 1a4981c8a870ee1de172fc04f4984112 SHA-1: 16047afdddb98e2ca7712fce9a7aa04db650074a SHA-256: 8faf7709170f5c932f61d92f83371661237719e517ff84be276bb55fd655ff0c

180 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1566.001 Spearphishing Attachment

The sample is a malicious OOXML document that leverages an altChunk to import an RTF file. This RTF file contains OLE objects and is configured to activate them via \objupdate, exploiting CVE-2026-21514, a Word/OLE security bypass. This indicates the document is designed to execute arbitrary code upon opening, likely as a downloader or initial access vector.

Heuristics 6

CVE-2026-21514 — Word/OLE security bypass in RTF high CVE likely CVE_2026_21514

(in altChunk RTF word/rafte.rtf) RTF contains a hidden \svb hex package with DrsE2oDoc and downRevStg drawing compatibility parts. This matches an observed CVE-2026-21514 exploitation shape that manipulates Word's internal document structure and trust decisions.
altChunk imports embedded RTF (RTF injection) critical OOXML_ALTCHUNK_RTF

Document inlines an embedded RTF via an aFChunk relationship and a <w:altChunk> body element. This is the canonical RTF-injection wrapper used to smuggle RTF exploits (Equation Editor / URL Moniker / objdata) past DOCX-only scanners. Word opens the wrapper and executes the RTF inline. Recursing into the RTF for the exact exploit primitive.
\objupdate forces OLE activation high RTF_OBJUPDATE

(in altChunk RTF word/rafte.rtf) RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

(in altChunk RTF word/rafte.rtf) RTF contains 2 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

(in altChunk RTF word/rafte.rtf) RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
- http://schemas.microsoft.com/office/drawing/2014/chartex
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/officeDocument/2006/math
- http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
- http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
- http://schemas.openxmlformats.org/wordprocessingml/2006/main
- http://schemas.microsoft.com/office/word/2010/wordml
- http://schemas.microsoft.com/office/word/2012/wordml
- http://schemas.microsoft.com/office/word/2015/wordml/symex
- http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
- http://schemas.microsoft.com/office/word/2010/wordprocessingInk
- http://schemas.microsoft.com/office/word/2006/wordml
- http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000af79f.bin` `41b20a73e8382f9dda76c735b6ed59cb998a426a7f16cdcff35b2f0b38b27249`	rtf-objdata-decoded	RTF \objdata at offset 0xAF79F	87092 bytes
`objdata_01_off000e93c4.bin` `31d0b0c8736350c29d658081251eef2ad4e59509fe8222d5a28340dc0162ca79`	rtf-objdata-decoded	RTF \objdata at offset 0xE93C4	583987 bytes
`rtf_svb_00000009.zip` `28fc295dafc0bcccd998d6dc34a4e9ae47eb34cb74cb4b892eb6454833467799`	rtf-svb-package	RTF \svb hex-decoded ZIP at offset 0x9	116932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.