Report - ilillil%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23ililili.doc

MS_RTF_Obfuscation_Objects RTF File doc

ScreenShot

Info
Location map


Created	2023.05.22 09:03	Machine	s1_win7_x6402
Filename	ilillil%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23ililili.doc
Type	Rich Text Format data, version 1, unknown character set
AI Score	Not founds	Behavior Score	4.4
ZERO API	file : mailcious
VT API (file)	28 detected (ObfsStrm, RTFObfustream, CVE-2017-1188, Camelot, Bloodhound, a variant of DOC, Abnormal, Malicious, score, dinbqn, Malformed, Obfuscated, RTFMALFORM, RtfExp, ai score=80, Detected, Malform, Probably Heur, RTFObfuscation)
md5	f83050a49383b5c615b9a84543254f4e
sha256	d8588e51d73dcf4b9ca0eeec7a4bbb184a32c0e769df76d075466289f60be95e
ssdeep	768:ccOjOLSOMHbgaOG+SNctKmitXIaepWiPGmH5id0ecqQPnKqIs40aqdR84MEdm:ccOj5OM7gaOG+xKmitXyp/7H5iShnyq4
imphash
impfuzzy

Network IP location

Signature (10cnts)

Level	Description
warning	File has been identified by 28 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	An application raised an exception which may be indicative of an exploit crash
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	One or more potentially interesting buffers were extracted
notice	Performs some HTTP requests
notice	RTF file has an unknown character set
info	One or more processes crashed

Rules (2cnts)

Level	Name	Description	Collection
warning	SUSP_INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.	binaries (upload)
info	Rich_Text_Format_Zero	Rich Text Format Signature Zero	binaries (upload)

Network (2cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://104.234.10.91/441/vbc.exe whois		VELCOM	104.234.10.91		clean
104.234.10.91 whois		VELCOM	104.234.10.91		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure