Report - OIUIII0IUII0Ioioioi0ioi0iouuuiii0i0oiooioi0oioIOOI0I0IOO0OIO000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000.doc

MS_RTF_Obfuscation_Objects RTF File doc

ScreenShot

Info
Location map


Created	2023.10.04 17:36	Machine	s1_win7_x6401
Filename	OIUIII0IUII0Ioioioi0ioi0iouuuiii0i0oiooioi0oioIOOI0I0IOO0OIO000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000000000000000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000000.doc
Type	ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : mailcious
VT API (file)	30 detected (CVE-2018-0802, ObfsObjDat, Save, CVE-2017-1188, multiple detections, Malicious, score, dinbqn, Malformed, CVE-2018-0798, RTFMALFORM, BadFile, Wacatac, Detected, Malform, RTFObfustream, ai score=82, Probably Heur, RTFBadHeader)
md5	130b68050fb2c995533b651154d8b472
sha256	6d01d2b7ba43bd9b9d19f875f269e9f0598754a5f6e84713fb5addb31a02a7fa
ssdeep	768:ssRck1ZFKnzS4KxVKKxcsNboX1euuyaOztsJwiDXLU:Gk1jK24KHKKqstoXOyagv
imphash
impfuzzy

Network IP location

Signature (9cnts)

Level	Description
danger	File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests
info	One or more processes crashed

Rules (3cnts)

Level	Name	Description	Collection
warning	MS_RTF_Suspicious_documents	Suspicious documents using RTF document OLE object	binaries (upload)
warning	SUSP_INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.	binaries (upload)
info	Rich_Text_Format_Zero	Rich Text Format Signature Zero	binaries (upload)

Network (6cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://apps.identrust.com/roots/dstrootcax3.p7c whois		Akamai International B.V.	23.67.53.17		clean
http://172.86.76.208/zh2/Wshp.vbs whois		QUICKPACKET	172.86.76.208		clean
uploaddeimagens.com.br whois		CLOUDFLARENET	172.67.215.45		malware
172.86.76.208 whois		QUICKPACKET	172.86.76.208		mailcious
23.50.121.137 whois		AKAMAI-AS	23.50.121.137		clean
172.67.215.45 whois		CLOUDFLARENET	172.67.215.45		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure