RTF malware analysis — malicious · a41d9d1c407b3b4d

MALICIOUS

RTF

378.5 KB First seen: 2019-04-18

MD5: edb8f69c2e690e64b73f7ff8c2a3aafa SHA-1: 26dcd7b81415e3472bd52de15e87b121d5257174 SHA-256: a41d9d1c407b3b4d91deedbcad7190cd9b6a33235458ea30bc38c0e141984d53

220 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The file is an RTF document containing OLE objects and specifically triggers heuristics related to Equation Editor vulnerabilities, including CVE_2018_0802. The presence of ".objupdate" and the "ENABLE EDITING TEXT" lure indicate an attempt to activate embedded exploits. This suggests the document is designed to exploit a client-side vulnerability for code execution, likely delivered via spearphishing.

Heuristics 6

Equation Editor CLSID critical CVE likely RTF_EQUATION_EDITOR

Equation Editor OLE CLSID found inside an OLE object — exploited by CVE-2017-11882 / CVE-2018-0802 / CVE-2018-0798
ClamAV: Rtf.Exploit.CVE_2018_0802-6825822-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2018_0802-6825822-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 4 \objdata section(s) — embedded OLE objects
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off0000009c.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x9C	464 bytes
SHA-256: `56e11ae343a4a3453934b8749a6e4d8a9c92374f1a1582320dc9c0567b303064`
`objdata_01_off0002e311.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x2E311	4679 bytes
SHA-256: `f8bfb193f9f11cf441a5c8a68b651c15a4340c7d97594e6e042cd1be19f59f20`

Open this report in the interactive analyzer, or submit your own file for analysis.