RTF malware analysis — malicious · d944abab1481457e

MALICIOUS

RTF

449.1 KB Created: 2025-07-16 First seen: 2026-02-03

MD5: 9d1ad28ba8644e9a8b7e133960cdb512 SHA-1: 65e8cadb4901556ff9da328d158bc02fa37faf27 SHA-256: d944abab1481457eacf9f1d08f835980c2146ec91513e2eb94714c6abaec5f34

262 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter

The RTF document contains multiple critical and high severity heuristic firings indicating exploitation of known Microsoft Office vulnerabilities, specifically CVE-2017-8759, CVE-2026-21509, and CVE-2026-21514. These exploits are designed to allow arbitrary code execution when the document is opened. The presence of OLE object data and embedded packages further supports the exploitation vector. While the document body appears to be a benign registration form, the underlying technical indicators point to a malicious exploit.

Heuristics 7

CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759

RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
CVE-2026-21509 — Shell.Explorer.1 CLSID in RTF critical CVE related CVE_2026_21509

RTF document contains the Shell.Explorer.1 CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} associated with CVE-2026-21509 (OLE/COM Killbit / Protected View bypass). Actively exploited in the wild.
CVE-2026-21514 — Word/OLE security bypass in RTF high CVE likely CVE_2026_21514

RTF contains a hidden \svb hex package with DrsE2oDoc and downRevStg drawing compatibility parts. This matches an observed CVE-2026-21514 exploitation shape that manipulates Word's internal document structure and trust decisions.
ClamAV: Rtf.Exploit.CVE_2026_21509-10059214-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Rtf.Exploit.CVE_2026_21509-10059214-0
OLE object data medium RTF_OBJDATA

RTF contains 1 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh17136\margl720\margr1060\margt515\margb444\gutter0\ltrsect

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00061dfa.bin` `e77e43cf1ffa8d318554179c0842ed37037b58d6357d5d2b77e8d03af78329b8`	rtf-objdata-decoded	RTF \objdata at offset 0x61DFA	3121 bytes
`rtf_svb_0005303f.zip` `24fbde106af5ff45250db4a2b6ed23e201a4109f88523e48b75b7660e5809573`	rtf-svb-package	RTF \svb hex-decoded ZIP at offset 0x5303F	1684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.