Report - TENTENTNTNTENTNTETNETNETNETNE%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23TNENTENETNTENTNETNTENTETNENTENTEN.doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.07.26 17:40 Machine s1_win7_x6401
Filename TENTENTNTNTENTNTETNETNETNETNE%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23TNENTENETNTENTNETNTENTETNENTENTEN.doc
Type ISO-8859 text, with very long lines, with CR, LF line terminators
AI Score Not founds Behavior Score
4.6
ZERO API
VT API (file) 32 detected (ObfsStrm, RTFObfustream, Save, CVE-2017-1188, Camelot, Bloodhound, a variant of DOC, Abnormal, Malicious, score, dinbqn, Malformed, Obfuscated, RTFMALFORM, BadFile, RtfExp, ai score=84, Detected, Malform, Probably Heur, RTFBadHeader, GenericKD)
md5 568895b24ab301b43808273df671c0ba
sha256 3d14e37c76e0c008c70af011938cec2c31488ea085efe744de59b61171153487
ssdeep 384:/L/FanwWmLHzYFpzOBfX8oMxh4TSBkroYaJJ6z0J7bJn0P0nIPbN0ofW5rPCPcpL:DowW2HzY7cfXLS8BaJJQ0J3Jn08nIz+n
imphash
impfuzzy
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 32 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
info One or more processes crashed

Rules (3cnts)

Level Name Description Collection
warning MS_RTF_Suspicious_documents Suspicious documents using RTF document OLE object binaries (upload)
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://107.175.202.150/110/ChromeSetup.exe US AS-COLOCROSSING 107.175.202.150
http://showip.net/ Unknown 162.55.60.2
showip.net Unknown 162.55.60.2
162.55.60.2 Unknown 162.55.60.2
107.175.202.150 US AS-COLOCROSSING 107.175.202.150

Suricata ids



Similarity measure (PE file only) - Checking for service failure