RTF malware analysis — malicious · a542fbfadf53e5a6

MALICIOUS

RTF

5.34 MB First seen: 2026-03-13

MD5: bdbfbf3300f26365c40dabac077d77cf SHA-1: 95636c17f51171781b8b5506df302cc2a31fa467 SHA-256: a542fbfadf53e5a6d3a3e7216fc0d9a24384c0bee039aab151c3c1a1e06e52dc

160 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1559.001 Component Object Model Hijacking

The RTF file contains an embedded OLE object with a split Equation Editor ProgID, triggering the RTF_EQUATION_EDITOR heuristic. The objupdate directive forces OLE activation, indicating an attempt to exploit the embedded object. The presence of excessive hex-encoded data within the objdata section suggests a hidden payload, likely leveraging the Equation Editor vulnerability for code execution.

Heuristics 4

Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR

RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX

RTF contains ~5601KB of hex-encoded data inside \objdata sections — may hide a payload
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000000f8.bin` `0f50d2c346b0ca9fb5c008ce3285db194058da87a16f25701c604a23b239ca93`	rtf-objdata-decoded	RTF \objdata at offset 0xF8	2800675 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.