Report - 000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000000%23%23%23%23%23%23%23%230.Doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.07.31 17:58 Machine s1_win7_x6402
Filename 000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000000%23%23%23%23%23%23%23%230.Doc
Type ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score Not founds Behavior Score
4.2
ZERO API
VT API (file) 29 detected (RTFObfustream, Save, ObfsStrm, CVE-2017-1188, Camelot, Bloodhound, multiple detections, Malicious, score, dinbqn, Malformed, RTFMALFORM, Detected, Probably Heur, RTFBadHeader, ai score=82)
md5 92bb79c8468691d39e3750967f235588
sha256 c51cff666338559d0e6e33666f7034a31d8411f3fc91b2af6bde2b9a6a78a0d2
ssdeep 1536:cJBMfdnCtN5DoVtfos5LBUbDtndQbpDWi4PfSy53ZzFiEn:cJBuA+BeDqDL4P6y/0En
imphash
impfuzzy
  Network IP location

Signature (8cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
warning File has been identified by 29 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice One or more potentially interesting buffers were extracted
info One or more processes crashed

Rules (3cnts)

Level Name Description Collection
warning MS_RTF_Suspicious_documents Suspicious documents using RTF document OLE object binaries (upload)
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
93.183.73.20 RU OOO MediaSeti 93.183.73.20

Suricata ids



Similarity measure (PE file only) - Checking for service failure