RTF malware analysis — malicious · e40862463a73dfb6

MALICIOUS

RTF

498.1 KB Created: 2018-06-04 05:58:00 First seen: 2021-02-23

MD5: 1d7c5aa42089f1fe2915d69d8b5116dd SHA-1: cf6f71e42c74a669fb4d4951dbae6dba56573089 SHA-256: e40862463a73dfb6537f6231828314fcc6a6959b6049b1c4ea55ba175afa8df3

282 Risk Score

Heuristics 8

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Generic-6834349-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Generic-6834349-0
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off000037a3.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x37A3	35899 bytes
SHA-256: `d1b004dc7cbb21cf19723e79f983e8dc852373502682466f6eb5f5192e1d2604`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_01_off0001a8cd.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x1A8CD	35899 bytes
SHA-256: `c8549f20f3daa3ac2a4fe3bd0dc6696fafdb60c31b4cc77f3c296460bc30b2c2`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_02_off000319f7.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x319F7	35899 bytes
SHA-256: `7ef5ea2f2cecbf5e4754d94676daa5a65887cc4183ec463d3cb73ca689b69864`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_03_off00048b21.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x48B21	35899 bytes
SHA-256: `b6f7e4faaab1ebceaec7ba79e1c253acf94a787c2f6aa2e473cbed605dd6d692`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely
`objdata_04_off0005fc4b.bin`	rtf-objdata-decoded	RTF \objdata at offset 0x5FC4B	35899 bytes
SHA-256: `c9efed2b6a8c79f1d17d7546ce9c30effa439372bb7ce7a0a5414e77e8a06d5e`
Detection ClamAV: Xls.Malware.Generic-6834349-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.