Report - %23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.05.03 09:33 Machine s1_win7_x6401
Filename %23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc
Type Rich Text Format data, version 1, unknown character set
AI Score Not founds Behavior Score
5.0
ZERO API file : mailcious
VT API (file) 31 detected (ObfsStrm, CVE-2017-1188, Camelot, multiple detections, Malicious, score, dinbqn, Malformed, RTFMALFORM, RtfExp, ai score=88, Woreflint, Detected, Malform, RTFObfustream, Probably Heur, RTFObfuscation)
md5 fc01e8909cd645434c82378c485c6aa7
sha256 a9ef7d016c5480becf56f2ef7527d97e0890b42fbe32ee59e5ef6eee14613a66
ssdeep 768:gKgykvu3gEsgY+bBTK9yeE/0Jl8sZPI5FtlfnhqG43GwmDg+:/VYiBO9y9KZQ5FtFn
imphash
impfuzzy
  Network IP location

Signature (11cnts)

Level Description
danger File has been identified by 31 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice RTF file has an unknown character set
info One or more processes crashed

Rules (2cnts)

Level Name Description Collection
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.eyelid.life/ks01/?2d=8rShw7wJxEptaFTQff8lMyjLWyKzmaTsdR/zpHphK8l0c9xMUYXECCyCH9CJ9wojd8KKPGKf&CXaDf=fTCLVPZpt04TEV7 JP GMO Internet,Inc 118.27.125.222 clean
http://185.225.74.77/000000_____/vbc.exe DE Mayak Smart Services Ltd. 185.225.74.77 malware
www.thenergy.africa Unknown clean
www.eyelid.life JP GMO Internet,Inc 118.27.125.222 clean
118.27.125.222 JP GMO Internet,Inc 118.27.125.222 clean
185.225.74.77 DE Mayak Smart Services Ltd. 185.225.74.77 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure