Malicious RTF — malware analysis report

Static analysis result for SHA-256 f17ca50c1f16ca20…

MALICIOUS

RTF

352.0 KB Created: 2020-08-05 04:52:00 First seen: 2020-09-07
MD5: a7325beb50c9daacdf18a3af15869304 SHA-1: dfda4d67494e299ebbf6dabdf89721799f03c8b9 SHA-256: f17ca50c1f16ca20f3d71bcd40c3bb9e3ef9c11b53c7c7458d29c1e1fe272827
382 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The RTF document contains multiple indicators of exploitation, including CVE-2017-8570, CVE-2017-8759, and CVE-2026-21514, which are known to facilitate arbitrary code execution through OLE object manipulation. The presence of OLE object data and composite monikers strongly suggests that the file is designed to exploit these vulnerabilities to drop and execute a secondary payload, likely a script or shellcode.

Heuristics 11

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • CVE-2017-8759 — MSXML SAX OLE activation critical CVE likely CVE_2017_8759
    RTF contains a hex-encoded OLE1 object for Msxml2.SAXXMLReader.6.0 followed by an embedded OLE compound document, and the document requests OLE activation. This matches the RTF staging shape used for CVE-2017-8759 SOAP/WSDL parser code injection.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • CVE-2026-21514 — Word/OLE security bypass in RTF high CVE likely CVE_2026_21514
    RTF contains a hidden \svb hex package with DrsE2oDoc and downRevStg drawing compatibility parts. This matches an observed CVE-2026-21514 exploitation shape that manipulates Word's internal document structure and trust decisions.
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • OLE object data medium RTF_OBJDATA
    RTF contains 4 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM
    RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2003/wordml In RTF body

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off0001c753.bin rtf-objdata-decoded RTF \objdata at offset 0x1C753 27270 bytes
SHA-256: 74cc997a36d770ecada89a275d5dc2b1202c2467e9fed052436a87027261f80e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): Wscript.Shell"" ) ")
objdata_01_off00029d64.bin rtf-objdata-decoded RTF \objdata at offset 0x29D64 12261 bytes
SHA-256: cfdf79b95584afe599f8bd01e391d8904839d9495e407a353433d3f5e3be3602
objdata_02_off0002fd74.bin rtf-objdata-decoded RTF \objdata at offset 0x2FD74 2632 bytes
SHA-256: 640df70a90931ea171b9bd39906ee065f8b6bb3d8f5d187057c6aa8339897ca6
rtf_svb_00003e9e.zip rtf-svb-package RTF \svb hex-decoded ZIP at offset 0x3E9E 1971 bytes
SHA-256: c9fb51442cdbdb8d3553baa033d13d8339772bb1d1d68b53c5f00f90cecf89d1

Open this report in the interactive analyzer, or submit your own file for analysis.