Malicious RTF — malware analysis report

Static analysis result for SHA-256 cb5760877a43e6fc…

MALICIOUS

RTF

250.6 KB Authoring application: Riched20 10.0.15063 First seen: 2019-04-18
MD5: 1791242a43764b12072ff92460694c16 SHA-1: 0a163f071b05e0dd4859fb255b8f1506fb3cc153 SHA-256: cb5760877a43e6fccd3961cdb4aaef158f046cd2d245fba58747575e34a719f8
100 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains multiple embedded OLE objects, with heuristics indicating that \objupdate forces OLE activation. This suggests the file is designed to exploit vulnerabilities within OLE object handling to achieve client execution. The specific exploit or payload is not directly discernible from the static analysis, leading to an unknown family classification.

Heuristics 4

  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 5 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0000010d.bin rtf-objdata-decoded RTF \objdata at offset 0x10D 24910 bytes
SHA-256: cdec6e5114b9ec899f804d4c7706188a6ab46f9b9ff8a89fe3332ae4d9605b56
objdata_01_off0000c95c.bin rtf-objdata-decoded RTF \objdata at offset 0xC95C 24910 bytes
SHA-256: 0fedbbc72c3cfa80d6be13b3e032918bf6758f9424702c5740b057b972718190
objdata_02_off000191ab.bin rtf-objdata-decoded RTF \objdata at offset 0x191AB 24910 bytes
SHA-256: 8b948efe19bbdd93ae3d9d31d67454c0a4a2c263538176f6a7314e09c8d53164
objdata_03_off000259fa.bin rtf-objdata-decoded RTF \objdata at offset 0x259FA 24910 bytes
SHA-256: 45330c961396673d39b72520369bf29e48423a46a1aaca461cd69ec38961c5b9
objdata_04_off00032249.bin rtf-objdata-decoded RTF \objdata at offset 0x32249 24910 bytes
SHA-256: e75a438abb555b8c2b8d47794ab415e05a0450ee1321a399db4af122b41ac74a

Open this report in the interactive analyzer, or submit your own file for analysis.