Xls.Malware.Sdrop-10036532-0 RTF malware analysis — malicious · a52fb8026426d816

MALICIOUS

RTF

1.14 MB Created: 2019-12-20 17:39:00

MD5: 236eb8b0de3b8d150e3f2ce62b1875ce SHA-1: b3502144eef8ce34abe685ba46d47bd8fb0f3750 SHA-256: a52fb8026426d81600866ce3bd1287b9e60f765fa28e777b4412ecc7e7f0b3e1

200 Risk Score

Malware Insights

Xls.Malware.Sdrop-10036532-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information

The RTF file contains multiple embedded OLE objects, with significant amounts of hex-encoded data within \objdata sections. The \objupdate heuristic indicates an attempt to force OLE activation, which is a common technique for delivering embedded malware. ClamAV detection as 'Xls.Malware.Sdrop-10036532-0' further supports the malicious nature of the file, likely indicating a downloader or dropper.

Heuristics 6

ClamAV: Xls.Malware.Sdrop-10036532-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sdrop-10036532-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~1002KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00003139.bin` `6d01f83d788a2878fc0512017d509a18f4b5b89aecd130fe039d49c1e6fd1dce`	rtf-objdata-decoded	RTF \objdata at offset 0x3139	119854 bytes
`objdata_04_off000f9801.bin` `e2e1aa02fde0a77b74029f9450024df87e5064c063c6ea4ca8ab116084a5acd9`	rtf-objdata-decoded	RTF \objdata at offset 0xF9801	88440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.