Malicious RTF — malware analysis report

Static analysis result for SHA-256 cc6920eb02605e75…

MALICIOUS

RTF

43.3 KB Created: 2017-08-03 16:39:00 First seen: 2017-08-08
MD5: 18eed9fae90825fb0c614336f15f25ae SHA-1: 7c44867a76d496b8ba3c9786c329053e8c885139 SHA-256: cc6920eb02605e75d6d8207585d714a01ba9812953eb74041f8e3adfbe7b0b5f
202 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The RTF file contains a weaponized URL exploiting CVE-2017-0199, which is designed to download and execute a HTA payload from the provided URL. The embedded OLE object data and the specific heuristic firings strongly indicate this exploit. The HTA payload is likely to contain JavaScript for further malicious actions.

Heuristics 6

  • CVE-2017-0199 (OLE2Link / weaponized URL) critical CVE exact CVE_2017_0199_WEAPONIZED_URL
    RTF contains a URL Moniker OLE link to a script/HTA/template-style remote loader, matching the tighter static CVE-2017-0199 shape.
  • ClamAV: Rtf.Exploit.CVE_2017_0199-6335035-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Exploit.CVE_2017_0199-6335035-0
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://a.pomf.cat/jnpuwu.hta In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00002748.bin rtf-objdata-decoded RTF \objdata at offset 0x2748 4664 bytes
SHA-256: d4dfd1176e476364b10a292f0dae7f5236b8813445c07f8dbf57731b5b100dbc

Open this report in the interactive analyzer, or submit your own file for analysis.