Classification: Malicious
mail.rtf is an exploit (RTF document, 221 bytes). Detected by 14 antivirus engines. 3 sightings, last seen 2026-10-18.
Detection summary
- 14 antivirus detections
- 0 IDS alerts
- 12 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2025-02-09 07:30:03 |
2026-10-18 04:45:04 |
malicious-activity
|
|
| Generic Malware |
Cyber Threat Alliance |
2026-09-28 19:00:42 |
2026-09-28 19:00:42 |
malicious-activity
|
|
Sample information
- Filenames
- mail.rtf
- File type
- Rich Text Format data, version 1
- Size
- 221 bytes
- MD5
9d68678aeee52684bbe3c983222b1da3- SHA-1
ba3ae643e20a26aca550b6888d9107e5d434959c- SHA-256
93ef57b81021be174e33b5b48c1aed525d2785c3607aeb540508bb3713690179- First indexed
- 2025-02-09 07:19:45
- Last updated
- 2026-09-28 19:00:42
Antivirus detections
| Engine | Detection |
|---|
| AVG | RTF:CVE-2025-21298-A [Expl] |
| AhnLab-V3 | Exploit/RTF.Generic |
| Avast | RTF:CVE-2025-21298-A [Expl] |
| Avira | TR/AVI.Agent.hllbf |
| Cynet | Malicious (score: 99) |
| F-Secure | Trojan.TR/AVI.Agent.hllbf |
| GData | Script.Trojan.Agent.075NIC |
| Google | Detected |
| Ikarus | Exploit.CVE-2025-21298 |
| Kaspersky | HEUR:Exploit.RTF.CVE-2025-21298.gen |
| Microsoft | Exploit:O97M/CVE-2025-21298 |
| Symantec | Trojan Horse |
| Tencent | Win32.Exploit.Cve-2025-21298.Dkjl |
| Varist | RTF/ABRisk.UXAY-3 |
Process list
| Name | Command line |
|---|
| WINWORD.EXE | /n "C:\mail.rtf" |
| WerFault.exe | -u -p 11148 -s 1932 |
| WerFault.exe | -u -p 11148 -s 1932 |
| WerFault.exe | -u -p 11148 -s 1932 |
| dwwin.exe | -x -s 1880 |
| WerFault.exe | -pss -s 448 -p 11148 -ip 11148 |
| WINWORD.EXE | /n "C:\mail.rtf" |
| WerFault.exe | -u -p 6180 -s 1624 |
| WerFault.exe | -u -p 6180 -s 1624 |
| WerFault.exe | -u -p 6180 -s 1624 |
| dwwin.exe | -x -s 844 |
| WerFault.exe | -pss -s 452 -p 6180 -ip 6180 |