popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a.dot

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x3201 April 23, 2021, 6:34 p.m. April 23, 2021, 6:38 p.m.
Size 9.0KB
Type data
MD5 fdd0b9ab0a8d70288ddef6337b62d151
SHA256 d7fff20cd5ea5385a79862bf1a74b3ddfeea8d04509d4f6c1bd65ca819a9eb0c
CRC32 F29736F7
ssdeep 192:P9MngD0sW6JfOfwgpDle9jLDjfGtNtEq9OOj56mfwLZhl:8ghtmwgpyD6KqwpDLZhl
Yara None matched

Name Response Post-Analysis Lookup
armyscheme.sytes.net
A 3.35.236.132
3.35.236.132
IP Address Status Action
164.124.101.2 Active Moloch
3.35.236.132 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49596 -> 3.35.236.132:80 2018219 ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain Potentially Bad Traffic
TCP 3.35.236.132:80 -> 192.168.56.103:49596 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x4b RpcExceptionFilter-0xf rpcrt4+0x1e106 @ 0x7799e106
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x770ff725
RpcMgmtSetCancelTimeout+0x107 NdrMesTypeAlignSize2-0x28 rpcrt4+0x24926 @ 0x779a4926
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x770fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x76ff98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x77041414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x77057b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6a214dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x6a7e92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x6aa68232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x6ac7c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x6ac8699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x6aa6a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6a7eb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6a74f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x69eb25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x69edfe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x69edf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6aa4e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6aa0168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x69e9a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x69e8876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x69e849e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f3e15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f3e155d
BaseThreadInitThunk+0x12 SetUnhandledExceptionFilter-0xbc kernel32+0x53c45 @ 0x762e3c45
RtlInitializeExceptionChain+0xef RtlFreeSid-0x117 ntdll+0x637f5 @ 0x77af37f5
RtlInitializeExceptionChain+0xc2 RtlFreeSid-0x144 ntdll+0x637c8 @ 0x77af37c8

exception.instruction_r: c9 c2 10 00 89 45 c0 eb ed 64 a1 18 00 00 00 8b
exception.symbol: RaiseException+0x54 BaseReleaseProcessDllPath-0x100 kernelbase+0xb760
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46944
exception.address: 0x75d8b760
registers.esp: 2183052
registers.edi: 1996552720
registers.eax: 2183052
registers.ebp: 2183132
registers.edx: 3283608
registers.ebx: 3766772
registers.esi: 2147944126
registers.ecx: 2652010934
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x4b RpcExceptionFilter-0xf rpcrt4+0x1e106 @ 0x7799e106
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x770ff725
RpcMgmtSetCancelTimeout+0x107 NdrMesTypeAlignSize2-0x28 rpcrt4+0x24926 @ 0x779a4926
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x770fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x76ff98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x76ffb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x76ffb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x76ffb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x76ffa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7707a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x770577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x770414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x77057b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6a214dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x6a7e92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x6aa68232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x6ac7c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x6ac8699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x6aa6a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6a7eb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6a74f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x69eb25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x69edfe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x69edf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6aa4e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6aa0168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x69e9a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x69e8876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x69e849e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f3e15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f3e155d
BaseThreadInitThunk+0x12 SetUnhandledExceptionFilter-0xbc kernel32+0x53c45 @ 0x762e3c45
RtlInitializeExceptionChain+0xef RtlFreeSid-0x117 ntdll+0x637f5 @ 0x77af37f5
RtlInitializeExceptionChain+0xc2 RtlFreeSid-0x144 ntdll+0x637c8 @ 0x77af37c8

exception.instruction_r: c9 c2 10 00 89 45 c0 eb ed 64 a1 18 00 00 00 8b
exception.symbol: RaiseException+0x54 BaseReleaseProcessDllPath-0x100 kernelbase+0xb760
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46944
exception.address: 0x75d8b760
registers.esp: 2182744
registers.edi: 1996552720
registers.eax: 2182744
registers.ebp: 2182824
registers.edx: 3283608
registers.ebx: 3766268
registers.esi: 2147944122
registers.ecx: 2652010934
1 0 0
domain armyscheme.sytes.net
request GET http://armyscheme.sytes.net/win/xles.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b41000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x048c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64cf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64cf4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x507c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x3f101000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64821000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x64822000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 1752 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x4b RpcExceptionFilter-0xf rpcrt4+0x1e106 @ 0x7799e106
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x770ff725
RpcMgmtSetCancelTimeout+0x107 NdrMesTypeAlignSize2-0x28 rpcrt4+0x24926 @ 0x779a4926
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x770fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x76ff98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x77041414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x77057b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6a214dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x6a7e92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x6aa68232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x6ac7c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x6ac8699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x6aa6a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6a7eb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6a74f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x69eb25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x69edfe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x69edf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6aa4e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6aa0168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x69e9a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x69e8876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x69e849e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f3e15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f3e155d
BaseThreadInitThunk+0x12 SetUnhandledExceptionFilter-0xbc kernel32+0x53c45 @ 0x762e3c45
RtlInitializeExceptionChain+0xef RtlFreeSid-0x117 ntdll+0x637f5 @ 0x77af37f5
RtlInitializeExceptionChain+0xc2 RtlFreeSid-0x144 ntdll+0x637c8 @ 0x77af37c8

exception.instruction_r: c9 c2 10 00 89 45 c0 eb ed 64 a1 18 00 00 00 8b
exception.symbol: RaiseException+0x54 BaseReleaseProcessDllPath-0x100 kernelbase+0xb760
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46944
exception.address: 0x75d8b760
registers.esp: 2183052
registers.edi: 1996552720
registers.eax: 2183052
registers.ebp: 2183132
registers.edx: 3283608
registers.ebx: 3766772
registers.esi: 2147944126
registers.ecx: 2652010934
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x4b RpcExceptionFilter-0xf rpcrt4+0x1e106 @ 0x7799e106
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x770ff725
RpcMgmtSetCancelTimeout+0x107 NdrMesTypeAlignSize2-0x28 rpcrt4+0x24926 @ 0x779a4926
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x770fc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x76ff98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x76ffb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x76ffb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x76ffb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x76ffa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x7707a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x770577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x770414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x77057b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x6a214dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x6a7e92a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x6aa68232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x6ac7c40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x6ac8699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x6aa6a206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6a7eb9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6a74f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x69eb25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x69edfe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x69edf54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6aa4e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6aa0168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x69e9a431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x69e8876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x69e849e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2f3e15d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2f3e155d
BaseThreadInitThunk+0x12 SetUnhandledExceptionFilter-0xbc kernel32+0x53c45 @ 0x762e3c45
RtlInitializeExceptionChain+0xef RtlFreeSid-0x117 ntdll+0x637f5 @ 0x77af37f5
RtlInitializeExceptionChain+0xc2 RtlFreeSid-0x144 ntdll+0x637c8 @ 0x77af37c8

exception.instruction_r: c9 c2 10 00 89 45 c0 eb ed 64 a1 18 00 00 00 8b
exception.symbol: RaiseException+0x54 BaseReleaseProcessDllPath-0x100 kernelbase+0xb760
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46944
exception.address: 0x75d8b760
registers.esp: 2182744
registers.edi: 1996552720
registers.eax: 2182744
registers.ebp: 2182824
registers.edx: 3283608
registers.ebx: 3766268
registers.esi: 2147944122
registers.ecx: 2652010934
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000374
filepath: C:\Users\Administrator\AppData\Local\Temp\~$a.dot
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\ADMINI~1\AppData\Local\Temp\~$a.dot
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
FireEye Exploit.RTF-ObfsObjDat.Gen
CAT-QuickHeal Exp.RTF.Obfus.Gen
McAfee Exploit-CVE2017-11882.bw
Cyren RTF/CVE-2017-11882.N.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 multiple detections
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsObjDat.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
MicroWorld-eScan Exploit.RTF-ObfsObjDat.Gen
Ad-Aware Exploit.RTF-ObfsObjDat.Gen
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.bw
Emsisoft Exploit.RTF-ObfsObjDat.Gen (B)
Avira HEUR/Rtf.Malformed
MAX malware (ai score=85)
GData Exploit.RTF-ObfsObjDat.Gen
AhnLab-V3 RTF/Malform-A.Gen
ALYac Exploit.RTF-ObfsObjDat.Gen
TACHYON Trojan-Exploit/RTF.CVE-2017-11882
Zoner Probably Heur.RTFBadHeader
Ikarus Exploit.CVE-2017-11882
Fortinet RTF/CVE_2017_11882.C!exploit