Report - ioi0OIOoi0IOIOIoi0OIOIioI0IOioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300ioi0ioiOI0oioiOIOI0ioIOIOI00%23%23%23%23%23%23%23%23%23%23%23%23%23%23000.doc

MS_RTF_Obfuscation_Objects RTF File doc

ScreenShot

Info
Location map


Created	2023.10.07 14:52	Machine	s1_win7_x6401
Filename	ioi0OIOoi0IOIOIoi0OIOIioI0IOioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300ioi0ioiOI0oioiOIOI0ioIOIOI00%23%23%23%23%23%23%23%23%23%23%23%23%23%23000.doc
Type	ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : mailcious
VT API (file)	33 detected (CVE-2018-0802, CVE-2018-0798, ObfsObjDat, BadFile, Save, CVE-2017-1188, multiple detections, Malicious, score, dinbqn, CLASSIC, Malformed, RTFMALFORM, Outbreak, Detected, Malform, RTFObfustream, Probably Heur, RTFBadHeader, Mgil, ai score=88)
md5	432af76c6e1aaf2f1848808a1ccb3f8b
sha256	6084216cf7ff4dbdf9047a82c60170eb8d09dc6003469dbf5c98465ca640f5f9
ssdeep	384:Y5lIguQzpP21R7EULzIejr/tYOe8jXF470PQsuLn3sKn+k:Y5mguqe1hEULzIejJYyjFy0PQsuLnP+k
imphash
impfuzzy

Network IP location

Signature (9cnts)

Level	Description
danger	File has been identified by 33 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests
info	One or more processes crashed

Rules (3cnts)

Level	Name	Description	Collection
warning	MS_RTF_Suspicious_documents	Suspicious documents using RTF document OLE object	binaries (upload)
warning	SUSP_INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.	binaries (upload)
info	Rich_Text_Format_Zero	Rich Text Format Signature Zero	binaries (upload)

Network (6cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://apps.identrust.com/roots/dstrootcax3.p7c whois		Akamai International B.V.	23.67.53.17		clean
http://103.182.16.23/250/3/HtmlCent.vbs whois			103.182.16.23		clean
uploaddeimagens.com.br whois		CLOUDFLARENET	104.21.45.138		malware
103.182.16.23 whois			103.182.16.23		malware
23.67.53.27 whois		Akamai International B.V.	23.67.53.27		clean
172.67.215.45 whois		CLOUDFLARENET	172.67.215.45		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure