popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

invc_0004500005000.wbk

doc RTF File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 1, 2021, 10:58 a.m. Nov. 1, 2021, 11:15 a.m.
Size 25.9KB
Type Rich Text Format data, unknown version
MD5 95b2667f1a1f47ebb18aeccc1a229443
SHA256 fbfbc6e81fb48d1ee2de7dd6ca830b58f5f5f9c41468052c730222db6bdac7ac
CRC32 7519A230
ssdeep 768:q3IB+SvswyCkWGP3vKPQ5t6cLsK3D2BdPcET:ASwHWGP3vwkt6U3icET
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000488
filepath: C:\Users\test22\AppData\Local\Temp\~$vc_0004500005000.wbk
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$vc_0004500005000.wbk
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
filetype_details Rich Text Format data, unknown version filename invc_0004500005000.wbk
Lionic Trojan.Multi.Generic.4!c
CAT-QuickHeal Rtf.Trojan.A2424150
McAfee RTFObfustream.e!95B2667F1A1F
Sangfor Malware.Generic-RTF.Save.c5a892ae
K7AntiVirus Trojan ( 0057b3a91 )
K7GW Trojan ( 0057b3a91 )
Arcabit Exploit.RTF-ObfsStrm.Gen
Cyren RTF/CVE-2017-11882.R.gen!Camelot
Symantec Bloodhound.RTF.20
ESET-NOD32 a variant of DOC/Abnormal.B
Avast Other:Malware-gen [Trj]
Cynet Malicious (score: 99)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.RTF-ObfsStrm.Gen
NANO-Antivirus Exploit.Rtf.Heuristic-rtf.dinbqn
MicroWorld-eScan Exploit.RTF-ObfsStrm.Gen
Ad-Aware Exploit.RTF-ObfsStrm.Gen
Sophos Troj/RtfExp-EQ
DrWeb Exploit.Rtf.Obfuscated.32
TrendMicro HEUR_RTFMALFORM
McAfee-GW-Edition Exploit-CVE2017-11882.yx
FireEye Exploit.RTF-ObfsStrm.Gen
Emsisoft Exploit.RTF-ObfsStrm.Gen (B)
Avira EXP/YAV.Minerva.klqcl
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASDOH.22A
Microsoft Exploit:O97M/CVE-2017-11882.IX!MTB
GData Exploit.RTF-ObfsStrm.Gen
AhnLab-V3 RTF/Malform-A.Gen
Zoner Probably Heur.RTFBadVersion
Tencent Office.Exploit.Generic.Hupe
Ikarus Exploit.CVE-2017-11882
Fortinet RTF/GenericKD.47107450!tr
AVG Other:Malware-gen [Trj]