← All detection heuristics · RTF / Equation Editor
critical
RTF_NIBBLE_SHIFTED_EQUATION_OBJECT
What it means
RTF objdata contains a half-byte-shifted CFB that realigns to a valid Microsoft Equation 3.0 object.
Why it fires
Attackers can prepend a single hexadecimal nibble so the CFB magic, directory, CLSID, and payload streams no longer occur on byte boundaries. The detector performs bounded realignment only when olefile validates the reconstructed compound file, its root CLSID is Microsoft Equation 3.0, and readable streams exist. It carves the reconstructed OLE and any case-insensitive Ole10Native payload for authenticated inspection and IOC extraction.