MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790
SHA3-384 hash:	4035c81f087814e60b2494ae9b072ee389f38b9c6dc467bcc50afb3abc450670af0ec53741cbe66a1972bf33b3088abc
SHA1 hash:	01a3230a0b7987e2ac597e33eaec256a40448484
MD5 hash:	828ff72e8d3dffcc232e6ae2ff100f45
humanhash:	july-wisconsin-sodium-nineteen
File name:	previewme.doc
Download:	download sample
File size:	103'624 bytes
First seen:	2026-02-03 13:15:36 UTC
Last seen:	Never
File type:	doc
MIME type:	text/rtf
ssdeep	768:qAUgKfstEXYqwSp1pzpXpopFpvpapZpMwn7KprwswOgwdwdwQk9TLeAHRNLSJ0s:qAUKtEIqFTF5SbN8bC0eZfmSCy9fZvts
TLSH	T1C5A353AC018C15E9D29251907F1FF0406D6BF9351CF18CA431EFCEBB60AE69AC9E7A11
TrID	83.3% (.RTF) Rich Text Format (5000/1) 16.6% (.JSON) JSON object (generic) (1000/1)
Magika	rtf
Reporter	smica83
Tags:	CVE-2026-21509 doc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

171

Origin country :

HU

Vendor Threat Intelligence

ACCE RTF_FileType

Malware configuration found for:

MSO

Details

MSO

extracted component(s) such as package(s) and OLE files

Link:

https://research.acce.ciphertechsolutions.com/results/ccec9c8b-4fa9-462a-896c-8b0207d35d49/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

previewme.doc

Verdict:

No threats detected

Analysis date:

2026-02-03 13:17:24 UTC

Tags:

ole-embedded generated-doc

Link:

https://app.any.run/tasks/2706a8d0-552e-4c75-9671-9e7b22a78153

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

Rtf.Exploit.CVE_2026_21509-10059214-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6981f50f183032faf3eee9b1

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Creating a window

Сreating synchronization primitives

Creating a file

Searching for the window

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Fake RTF File

Link:

https://app.docguard.net/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

explorer

Link:

https://www.filescan.io/uploads/6981f50e981ff1d38a467e0d/reports/7847f660-b3c5-4dff-948b-09af40898466/overview

Hybrid Analysis Rtf.Exploit.CVE_2026_21509

Verdict:

Malicious

Labled as:

Rtf.Exploit.CVE_2026_21509

Link:

https://www.hybrid-analysis.com/sample/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

/10

Score Malicious:

%

Score Benign:

1%

Link:

https://www.malware.ai/gui/files/?id=9d01a8a7-6819-4a31-a16b-6f97d7b149ce

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

rtf

First seen:

2026-02-02T09:02:00Z UTC

Last seen:

2026-02-02T09:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1862422

Signature

Malicious sample detected (through community Yara rule)

Office drops RTF file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790

ReversingLabs TitaniumCloud Document-RTF.Exploit.CVE-2026-21509

Threat name:

Document-RTF.Exploit.CVE-2026-21509

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-28 13:51:56 UTC

File Type:

Document

Extracted files:

16

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6dkegbkripf5nphi56llklkdbyw3gintpofzhivj2a2umulqe6ia._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/260203-qhqv1aa17b/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790