Report - rsrsrsrsrsrrsrsrsrsrsrsrssrsrsr%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23rsrsrsrsrsrsrsrsrsrs.doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.06.08 17:45 Machine s1_win7_x6402
Filename rsrsrsrsrsrrsrsrsrsrsrsrssrsrsr%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23rsrsrsrsrsrsrsrsrsrs.doc
Type Rich Text Format data, version 1, unknown character set
AI Score Not founds Behavior Score
5.0
ZERO API file : mailcious
VT API (file) 30 detected (Obfuscated, RTFObfustream, ObfsStrm, Save, CVE-2017-1188, Camelot, Bloodhound, a variant of DOC, Abnormal, Malicious, score, dinbqn, Malformed, RTFMALFORM, RtfExp, Detected, Malform, Probably Heur, RTFObfuscation, ai score=80, GenericKD)
md5 39669a47b553f5d6b3ed6b730d7852f9
sha256 8e353c1f1a7b0ddea3289b04cb2fb2bde6eacb21298cca8a0c2af37081e5be8d
ssdeep 384:d8eKvpZlj7bLrJU/Wx1mEIZBFhqeq/d7SZ7DPvZ5pfiZcp2k4V7qQsqG14uT+hS1:dBeZljnLrJUOx180luZfp3p2kA7q1qED
imphash
impfuzzy
  Network IP location

Signature (11cnts)

Level Description
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice RTF file has an unknown character set
info One or more processes crashed

Rules (2cnts)

Level Name Description Collection
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (12cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://107.172.148.217/re/rs/IRjVevieEjoNGeLpLWfDSZKIoW131.bin US AS-COLOCROSSING 107.172.148.217 mailcious
http://www.parimaladragonflywellness.life/gtt8/?WZ=C+0/87yis/Zlv4qd7l9geBDqQKvoMWPO9Bv6EyyNy79humck0b/iQDmOl3lSHHtefS401NFg&Rv=X2JXNdDX_20Dj04 US SQUARESPACE 198.185.159.144 clean
http://www.lennartjahn.com/gtt8/?WZ=OdtWE4DAxERL7SMiEfq8Qou+0omTbT/PNs+Z6OFSeBqZ4lp4mdBeKi3j+/SgzRhga1nsl2MQ&Rv=X2JXNdDX_20Dj04 US CLOUDFLARENET 104.21.63.182 clean
http://107.172.148.217/245/hkcmd.exe US AS-COLOCROSSING 107.172.148.217 malware
http://www.meuble-chaussure-entree.site/gtt8/?WZ=yCnQ5L6NlcTRcn+ifIq7oQPvIlFV2UDOCQ1NjUaFJYn2MwS8YusSoR7wSYegmy6tKiXh+Vbc&Rv=X2JXNdDX_20Dj04 IT Register S.p.A. 81.88.57.68 clean
www.meuble-chaussure-entree.site IT Register S.p.A. 81.88.57.68 clean
www.lennartjahn.com US CLOUDFLARENET 104.21.63.182 clean
www.parimaladragonflywellness.life US SQUARESPACE 198.49.23.144 clean
198.49.23.145 US SQUARESPACE 198.49.23.145 mailcious
172.67.171.154 US CLOUDFLARENET 172.67.171.154 clean
107.172.148.217 US AS-COLOCROSSING 107.172.148.217 malware
81.88.57.68 IT Register S.p.A. 81.88.57.68 mailcious

Suricata ids



Similarity measure (PE file only) - Checking for service failure