Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Sept. 13, 2024, 9:22 a.m. | Sept. 13, 2024, 9:25 a.m. |
-
WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\gooddaycomingwithgoodthingsentiretimethingshappydayscomingverysoonitscomplicatedmetogetmebackwithentirethingstobe_________greatdaysarehere.doc
1488
Name | Response | Post-Analysis Lookup |
---|---|---|
ia600100.us.archive.org | 207.241.227.240 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.103:49166 -> 207.241.227.240:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.103:49167 -> 207.241.227.240:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://107.172.148.248/82/pictureonmewithgreatthingsonhere.tIF |
request | GET http://107.172.148.248/82/pictureonmewithgreatthingsonhere.tIF |
file | C:\Users\test22\AppData\Local\Temp\~$oddaycomingwithgoodthingsentiretimethingshappydayscomingverysoonitscomplicatedmetogetmebackwithentirethingstobe_________greatdaysarehere.doc |
filetype_details | Rich Text Format data, version 1, unknown character set | filename | gooddaycomingwithgoodthingsentiretimethingshappydayscomingverysoonitscomplicatedmetogetmebackwithentirethingstobe_________greatdaysarehere.doc |
host | 107.172.148.248 |
Cynet | Malicious (score: 99) |
CTX | malware (ai score=89) |
CAT-QuickHeal | Exp.RTF.Obfus.Gen |
McAfee | RTFObfustream.c!4DADA1C43D82 |
VIPRE | Exploit.RTF-ObfsObjDat.Gen |
Sangfor | Malware.Generic-RTF.Save.ecfa366c |
Arcabit | Exploit.RTF-ObfsObjDat.Gen |
Symantec | Bloodhound.RTF.20 |
ESET-NOD32 | multiple detections |
Avast | RTF:Obfuscated-gen [Trj] |
Kaspersky | HEUR:Exploit.MSOffice.Generic |
BitDefender | Exploit.RTF-ObfsObjDat.Gen |
NANO-Antivirus | Exploit.Rtf.Heuristic-rtf.dinbqn |
MicroWorld-eScan | Exploit.RTF-ObfsObjDat.Gen |
Rising | Exploit.Generic!1.EB5C (CLASSIC) |
Emsisoft | Exploit.RTF-ObfsObjDat.Gen (B) |
F-Secure | Heuristic.HEUR/Rtf.Malformed |
DrWeb | Exploit.CVE-2017-11882.123 |
TrendMicro | HEUR_RTFMALFORM |
Sophos | Troj/RtfExp-EQ |
Ikarus | Exploit.CVE-2017-11882 |
FireEye | Exploit.RTF-ObfsObjDat.Gen |
Detected | |
Avira | HEUR/Rtf.Malformed |
Antiy-AVL | Trojan[Exploit]/MSOffice.CVE-2017-11882 |
ZoneAlarm | HEUR:Exploit.MSOffice.Generic |
GData | Exploit.RTF-ObfsObjDat.Gen |
Varist | CVE-2017-11882.C.gen!Camelot |
AhnLab-V3 | OLE/Cve-2017-11882.Gen |
Zoner | Probably Heur.RTFObfuscation |
huorong | Exploit/CVE-2017-11882.gen |
Fortinet | MSOffice/CVE_2017_11882.DMP!exploit |
AVG | RTF:Obfuscated-gen [Trj] |