Report - pablozx.doc

Loki MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.07.12 14:50 Machine s1_win7_x6402
Filename pablozx.doc
Type Rich Text Format data, version 1, unknown character set
AI Score Not founds Behavior Score
4.6
ZERO API file : mailcious
VT API (file) 35 detected (CVE-2018-0802, ObfsObjDat, Save, CVE-2017-1188, Camelot, Malicious, score, dinbqn, Hplw, Minerva, fqjgl, CVE-2018-0798, RTFMALFORM, RTFDl, ai score=87, LokiBot, Detected, Malform, RTFObfustream, Probably Heur, RTFObfuscation, AvsRicher, bZAyIk, Outbreak)
md5 6bad9606e870b69823f32c9255c194c4
sha256 b9c1c77e731b1f7c049cf8578367a8615f182f0ac6539cd1bc7b1b729d63557b
ssdeep 768:KFx0XaIsnPRIa4fwJM2Q9StVuXrk4LvL4B:Kf0Xvx3EMPSeXr1L4B
imphash
impfuzzy
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice RTF file has an unknown character set
notice Sends data using the HTTP POST Method
info One or more processes crashed

Rules (2cnts)

Level Name Description Collection
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://171.22.30.164/pablo/five/fre.php DE CMCS 171.22.30.164 35071 mailcious
http://87.121.221.212/pablozx.exe Unknown 87.121.221.212 malware
171.22.30.164 DE CMCS 171.22.30.164 mailcious
87.121.221.212 Unknown 87.121.221.212 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure