Report - %23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc

MS_RTF_Obfuscation_Objects RTF File doc

ScreenShot

Info
Location map


Created	2023.05.03 09:38	Machine	s1_win7_x6401
Filename	%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23.doc
Type	Rich Text Format data, version 1, unknown character set
AI Score	Not founds	Behavior Score	4.0
ZERO API	file : mailcious
VT API (file)
md5	4666ed7dbe4480fa15249382b4d8a296
sha256	f97acdb8ea39e38826df305fb19b0b23ca17c301a2c7f5be4bc2ce28def25d99
ssdeep	768:SAMEQLV+kGQUc7ZG9NTBDlLOK3h2pcYCacVaNz9mY/RFcu:4x5v77ZG9NLOK34LewmmRJ
imphash
impfuzzy

Network IP location

Signature (10cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	One or more potentially interesting buffers were extracted
notice	Performs some HTTP requests
notice	RTF file has an unknown character set
info	One or more processes crashed

Rules (2cnts)

Level	Name	Description	Collection
warning	SUSP_INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.	binaries (upload)
info	Rich_Text_Format_Zero	Rich Text Format Signature Zero	binaries (upload)

Network (3cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://75.127.7.184/46/vbc.exe whois		AS-COLOCROSSING	75.127.7.184		clean
65.21.119.52 whois			65.21.119.52		clean
75.127.7.184 whois		AS-COLOCROSSING	75.127.7.184		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure