Report - extracted_at_0x1d15f.rtf

MS_RTF_Obfuscation_Objects
ScreenShot
Created 2023.03.16 09:28 Machine s1_win7_x6401
Filename extracted_at_0x1d15f.rtf
Type ASCII text, with no line terminators
AI Score Not founds Behavior Score
0.8
ZERO API file : clean
VT API (file)
md5 f2f52987a8386d72d9ad7796aeeea31c
sha256 55b4594903aa3eac62fbaab1e2dd25ec9dbce0474591bb96991c324622747e5d
ssdeep 3:geRUFgKXRXGXjDBUMdvnQBWAHGrEHvGNaDKrs1xEB5nLtgi:VtnXjDBnvnQgOGrueN+K41xQpt9
imphash
impfuzzy
  Network IP location

Signature (2cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates hidden or system file

Rules (1cnts)

Level Name Description Collection
warning MS_RTF_Suspicious_documents Suspicious documents using RTF document OLE object binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure