Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 a4a4d6db08ecba14…

MALICIOUS

RTF / .DOC

250.8 KB
MD5: 0c75fab21beef4d0996a31fda11e11b0 SHA-1: c0239c8ed34e560bf6a01f9c692d19648f0ad3a4 SHA-256: a4a4d6db08ecba14cf5d790b535d43e7b8bafbb1b93833010c2179a220edf33e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains multiple OLE objects, with heuristics indicating that \objupdate forces OLE activation and a Composite Moniker is present. The document body explicitly instructs the user to 'click Enable Editing to view the document', a common lure to bypass macro security settings. This suggests the document is designed to exploit OLE object activation to deliver a payload.

Heuristics 6

  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000b62.bin
3958bfbb484af280dcf02960aaf44ff9f2a77155ea4985c61494290316781b4f		 rtf-objdata-decoded RTF \objdata at offset 0xB62 32301 bytes
objdata_01_off000108c1.bin
12289ea42203fe86d5d6e86e52672f752ead5709842d0443203b40a4917d5ece		 rtf-objdata-decoded RTF \objdata at offset 0x108C1 12261 bytes
objdata_02_off000168d1.bin
ff4e9aaf9384b52652b79eaca517ccbf97d52846b4e013a0558d5ada8d82dc18		 rtf-objdata-decoded RTF \objdata at offset 0x168D1 2632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.