MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206
SHA3-384 hash:	b18be172bcd2243f2e758dd0013ce10f7e131d83459b15a3ac9797db032c0a82fcc708c6c995fb579acaa4ba04534571
SHA1 hash:	0e60e7aa2833e51fdbaf0495e58b203570492e28
MD5 hash:	65d42056f48f16bc098f157894341895
humanhash:	venus-batman-failed-social
File name:	cori.doc
Download:	download sample
File size:	16'816 bytes
First seen:	2026-03-27 10:12:25 UTC
Last seen:	2026-03-27 11:23:34 UTC
File type:	doc
MIME type:	text/rtf
ssdeep	192:G8U6fN8eXiY2rN7vQthf6phgN3bRhYDyJcLf:V7fulY2rN7vQtV6ngN39SLf
TLSH	T18472F33824324A47DD226285182FF41E2AF3F64FB4D8C8F15677C3B7E272B496246679
TrID	83.3% (.RTF) Rich Text Format (5000/1) 16.6% (.JSON) JSON object (generic) (1000/1)
Magika	rtf
Reporter	smica83
Tags:	CVE-2026-21509 doc

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

280

Origin country :

FR

Vendor Threat Intelligence

ACCE RTF_FileType

Malware configuration found for:

MSO

Details

MSO

extracted component(s) such as package(s) and OLE files

Link:

https://research.acce.ciphertechsolutions.com/results/f42bf4c4-502b-40d6-b80c-b1f5bf82bdb5/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

cori.doc

Verdict:

No threats detected

Analysis date:

2026-03-27 10:12:56 UTC

Tags:

ole-embedded

Link:

https://app.any.run/tasks/0c7031e3-647e-4f84-b151-d7284e47d4b9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.10250.14030.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c6583eaacb4c376b14911f

Tags:

office virus remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Fake RTF File

Link:

https://app.docguard.net/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

CVE_2026_21509 exploit

Link:

https://www.filescan.io/uploads/69c6583b2346b9da57aad3b4/reports/35f5ec98-3c14-414e-93e3-f2dd674803e3/overview

Hybrid Analysis TR/Obfuscated

Verdict:

Suspicious

Labled as:

TR/Obfuscated

Link:

https://www.hybrid-analysis.com/sample/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

10/10

Score Malicious:

1%

Score Benign:

0%

Link:

https://www.malware.ai/gui/files/?id=e8b6c056-5c44-40ac-aa76-8b734f68330b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rtf

First seen:

2026-03-27T07:11:00Z UTC

Last seen:

2026-03-28T08:09:00Z UTC

Hits:

~10

Detections:

Trojan.MSOffice.SAgent.sb HEUR:Exploit.MSOffice.CVE-2026-21509.gen

Link:

https://opentip.kaspersky.com/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad.spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1890080

Signature

Document Viewer accesses SMB path (likely to steal NTLM hashes or to download payload)

Malicious sample detected (through community Yara rule)

Microsoft Office loads Shell.Explorer.1 (likely related to CVE-2026-21509)

Multi AV Scanner detection for submitted file

Office drops RTF file

Opens network shares

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206/

Neiki Exploit.MSOffice.CVE-2026-21509

Verdict:

Malicious

Threat:

Exploit.MSOffice.CVE-2026-21509

Link:

https://tip.neiki.dev/file/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206

ReversingLabs TitaniumCloud Document-RTF.Exploit.CVE-2026-21509

Threat name:

Document-RTF.Exploit.CVE-2026-21509

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-27 10:13:20 UTC

File Type:

Document

Extracted files:

6

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kibhblps6l3jailrhx5plslb3cf2rmdkktmfy2fxhpczb3yo6ida._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/260327-l87h8aav8z/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206