Malicious RTF — malware analysis report

Static analysis result for SHA-256 e2e07bf7f0514c5f…

MALICIOUS

RTF

18.2 KB First seen: 2026-06-24
MD5: 0cfe612ca68547a276773533f6688237 SHA-1: 5cc49e648d0a42ae2d75c0563e6401b38f2b9209 SHA-256: e2e07bf7f0514c5f8371669ce0f344aa2e05be8506758419ac41888d77281f2f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF file contains embedded OLE object data and uses \objupdate to force OLE activation, indicating an attempt to exploit a vulnerability. Specifically, the 'RTF_EQUATION_EDITOR' heuristic firing points to a known exploit targeting Microsoft Equation Editor. This exploit likely serves as a dropper for a secondary payload, as suggested by the ClamAV detection name 'Rtf.Dropper.Agent-9237467-0'.

Heuristics 4

  • Split hex Equation Editor ProgID + OLE object critical CVE likely RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • ClamAV: Rtf.Dropper.Agent-9237467-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Rtf.Dropper.Agent-9237467-0
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 1 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000013d3.bin rtf-objdata-decoded RTF \objdata at offset 0x13D3 1897 bytes
SHA-256: a948ece4cffb5b668c84b1a9d63e3dd28e67d237e303bdcd47adbf6a560cff70

Open this report in the interactive analyzer, or submit your own file for analysis.