Report - teambzx.doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.06.03 17:25 Machine s1_win7_x6403
Filename teambzx.doc
Type Rich Text Format data, version 1, unknown character set
AI Score Not founds Behavior Score
5.6
ZERO API file : mailcious
VT API (file) 33 detected (CVE-2018-0802, CVE-2018-0798, RTFObfustream, Save, CVE-2017-1188, Camelot, Malicious, score, GenericKDZ, dinbqn, Gjgl, Malformed, CVE-2020-1711, CVE201711882, RTFDl, Detected, Malform, Probably Heur, RTFObfuscation, ai score=82)
md5 8a5c3b0f57f61e18ff31ae4903f479fa
sha256 10687220021a776a401570d83c20d5adf289a8f41c48f48bb76b5c92184a6bc4
ssdeep 768:gFx0XaIsnPRIa4fwJMkuVWuyNRHSbURHx4/fjB8M9dvwyUMaiZ0qKa41kG:gf0Xvx3EM/IRmfN39mM3ZAa41kG
imphash
impfuzzy
  Network IP location

Signature (12cnts)

Level Description
danger File has been identified by 33 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
watch Makes SMTP requests
notice An application raised an exception which may be indicative of an exploit crash
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Looks up the external IP address
notice Performs some HTTP requests
notice RTF file has an unknown character set
info One or more processes crashed

Rules (2cnts)

Level Name Description Collection
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (10cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://x1.i.lencr.org/ US Akamai International B.V. 104.76.70.102 clean
http://194.180.48.59/teambzx.exe Unknown 194.180.48.59 malware
https://api.ipify.org/ US WEBNX 173.231.16.76 clean
x1.i.lencr.org US Akamai International B.V. 104.76.70.102 clean
mail.grad-vodice.hr US UNIFIEDLAYER-AS-1 108.179.208.47 clean
api.ipify.org US WEBNX 104.237.62.211 clean
108.179.208.47 US UNIFIEDLAYER-AS-1 108.179.208.47 clean
173.231.16.76 US WEBNX 173.231.16.76 clean
194.180.48.59 Unknown 194.180.48.59 malware
104.76.70.102 US Akamai International B.V. 104.76.70.102 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure