Report - IOI0OIOoioi0ooooi00IOIOoi0OoI00IIoioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000oi0ioio0OIOI0ioooI0IOioiOI0ioII%23%23%23%23%23%23%23%23%23%23%23%23%2300000000.doc

MS_RTF_Obfuscation_Objects RTF File doc

ScreenShot

Info
Location map


Created	2023.10.07 14:52	Machine	s1_win7_x6403
Filename	IOI0OIOoioi0ooooi00IOIOoi0OoI00IIoioi0000%23%23%23%23%23%23%23%23%23%23%23%23%23%23000oi0ioio0OIOI0ioooI0IOioiOI0ioII%23%23%23%23%23%23%23%23%23%23%23%23%2300000000.doc
Type	ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : mailcious
VT API (file)	35 detected (CVE-2018-0802, ObfsObjDat, BadFile, RTFObfustream, Save, CVE-2017-1188, multiple detections, Malicious, score, dinbqn, Bkjl, Malformed, CVE-2018-0798, RTFMALFORM, Detected, eozdw, ai score=89, Casdet, ABRisk, JNWQ, Malform, Probably Heur, RTFBadHeader, CLASSIC)
md5	7284a3e9895de3839eeef2bf59e595ee
sha256	6a6690a8f64a0194bc3c77f8b195d8b7aa2d28e2f563374b006b1bebbd3c5c33
ssdeep	384:hWxD74AzsGSau+gFnONtJJlTu+qmfzYWPLNpeSH4VE5mvONTgKzb:HAz8xAvJ5qmfM02O4VPvUP
imphash
impfuzzy

Network IP location

Signature (9cnts)

Level	Description
danger	File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	An application raised an exception which may be indicative of an exploit crash
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Creates (office) documents on the filesystem
notice	Creates hidden or system file
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests
info	One or more processes crashed

Rules (3cnts)

Level	Name	Description	Collection
warning	MS_RTF_Suspicious_documents	Suspicious documents using RTF document OLE object	binaries (upload)
warning	SUSP_INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.	binaries (upload)
info	Rich_Text_Format_Zero	Rich Text Format Signature Zero	binaries (upload)

Network (6cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://103.182.16.23/250/1/html.vbs whois			103.182.16.23		clean
http://apps.identrust.com/roots/dstrootcax3.p7c whois		Akamai International B.V.	23.67.53.17		clean
uploaddeimagens.com.br whois		CLOUDFLARENET	104.21.45.138		malware
103.182.16.23 whois			103.182.16.23		malware
121.254.136.18 whois		LG DACOM Corporation	121.254.136.18		clean
104.21.45.138 whois		CLOUDFLARENET	104.21.45.138		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure