Malicious RTF — malware analysis report

Static analysis result for SHA-256 a403022bbdd049b8…

MALICIOUS

RTF

675.4 KB Created: 2010-04-21 07:54:00
MD5: f474cbdfac3345b24b7aeb80e24f29e1 SHA-1: bb166deff9d13d489805f6889e0a56a7427544f6 SHA-256: a403022bbdd049b836e8c41f73f75dbb08549b72fb942fc302fb890836f2e9dc
220 Risk Score

Malware Insights

MITRE ATT&CK
T1559.001 Component Object Model Hijacking T1204.002 Malicious File

The RTF file contains embedded OLE objects, including a package object, and exhibits characteristics of a known Word/OLE security bypass vulnerability (CVE_2026_21514). This suggests the file is designed to exploit this vulnerability to deliver a malicious payload. The presence of PE header in hex data further indicates the embedded object is likely an executable. No specific malware family could be identified from the available evidence.

Heuristics 7

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • CVE-2026-21514 — Word/OLE security bypass in RTF high CVE likely CVE_2026_21514
    RTF document contains an embedded OLE object with an Ole10Native stream. CVE-2026-21514 exploits OLE stream metadata validation in Word; the Ole10Native stream is used to deliver payloads and trigger the bypass when the document is opened.
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • Package object class high RTF_OBJCLASS_PACKAGE
    OLE Package object — can wrap arbitrary files
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.actamat.org/article/S1359-6454%2802%2900021-6/abstract
    • http://www.actamat.org/article/S1359-\hich\af0\dbch\af37\loch\f0
    • http://schemas.microsoft.com/office/word/2003/wo
    • http://en.wikipedia.org/wiki/Energy-dispersive_X-ray_spectroscopy
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TX5-4W0WJ0X-3&_
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TX5-4T54285-1&_user=10&_coverDate=05%2F31%2
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TX5-4B3NMF6-1&_user=10&_coverDate=06%2F30%2F2004&_alid=1278238991&_rdoc=5&_fmt=high&_or\hich\af0\dbch\af37\loch\f0
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TY2-48GVPC3-1&_user=10&_coverDate=07%2F31%2F2003&_alid=1278243073&_rdoc=1&_fmt=high&_orig=search&_cdi=5606&_sort=r&_do\hich\af0\dbch\af37\loch\f0
    • http://www.sciencedirect.com/science/journal/10445803
    • http://www.sciencedirect.com/science?_ob=PublicationURL&_tockey=%23TOC%235592%232008%23999409992%23690557%23FLA%23&_cdi=5592&_pubType=J&view=c&_auth=y&_acct=C000050221&_version=1&_urlVersion=0&_userid=10&md5=60a329fd879cf3807ca99c7be3b5cf64
    • http://www.sciencedirect.com/science/journal/09240136
    • http://www.sciencedirect.com/science/journal/13596454
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B82XX-4P5K\hich\af0\dbch\af37\loch\f0
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TWS-4TVTJS
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TX5-4Y5GXSD-3&_user=10&_coverDate=06%2F30%2F2010&_alid=1277635085&_rdoc=2&_fmt=high&_orig=search&_cdi=5581&_sort=r&_docanchor=&view=c&_ct=
    • http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TX5-4GV8STV-1&_user=10&_coverDate=12%2F31%2F2007&_alid=1277635085&_rdoc=4&_fmt=high&_orig=search&_cdi=5581&_sort=r&_docanchor=&view=c&_ct=42&_acct=C000050221&_version=1&_urlVersion=0&_userid

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000ac1e.bin
da17f500e913d488dd14d7c716f3c7b203e01c5ec5bddf20a70d14423fdcd7b2		 rtf-objdata-decoded RTF \objdata at offset 0xAC1E 45015 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.