Xls.Malware.Sload-7135989-0 RTF malware analysis — malicious · fb90fcbe97206396

MALICIOUS

RTF

323.2 KB Authoring application: Riched20 10.0.17134

MD5: 13ccccc0f82c793436f8b74b38fd2f32 SHA-1: 089766989b0c08d8a5a8779aaf772e5cf1fba0d9 SHA-256: fb90fcbe97206396766c689054e2fb24503105b21c68c4a6ea4ebe717223a41c

260 Risk Score

Malware Insights

Xls.Malware.Sload-7135989-0 · confidence 95%

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The RTF file contains multiple embedded OLE objects, indicated by RTF_OBJDATA and RTF_OBJEMB heuristics. The presence of RTF_OBJUPDATE and CLAMAV_DETECTION with the signature Xls.Malware.Sload-7135989-0 strongly suggests that these embedded objects are malicious and intended for exploitation. The ClamAV detection on an extracted artifact further corroborates the malicious nature of the embedded content.

Heuristics 7

Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED

RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
ClamAV: Xls.Malware.Sload-7135989-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sload-7135989-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
\objupdate forces OLE activation high RTF_OBJUPDATE

RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
OLE object data medium RTF_OBJDATA

RTF contains 5 \objdata section(s) — embedded OLE objects
Embedded OLE object medium RTF_OBJEMB

RTF contains \objemb — embedded OLE object
OlePres presentation stream in RTF OLE object medium RTF_OLEPRES_STREAM

RTF contains an embedded OLE object with an OlePres presentation stream. OlePres is an OLE presentation marker and is not enough on its own to identify CVE-2025-21298.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`objdata_00_off00000113.bin` `ff544cce8003311ab3be07b56348fcaa0066a1e8bb737634e9231fba8380cfae`	rtf-objdata-decoded	RTF \objdata at offset 0x113	32160 bytes
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely
`objdata_03_off0003084e.bin` `c92f11fa710c04e4059b1c31fc67278a859eecb3a070c1759f5442cc539449a2`	rtf-objdata-decoded	RTF \objdata at offset 0x3084E	32160 bytes
Detection ClamAV: Xls.Malware.Sload-7135989-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.