Report - HTMLprofile.dOC

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2023.10.25 09:52 Machine s1_win7_x6401
Filename HTMLprofile.dOC
Type ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score Not founds Behavior Score
3.2
ZERO API file : mailcious
VT API (file) 30 detected (BadFile, RTFObfustream, Save, ObfsObjDat, Bloodhound, multiple detections, Malicious, score, OLE2, dinbqn, Malformed, CVE-2018-0798, RTFMALFORM, ai score=88, CVE-2017-1188, Detected, Malform, Probably Heur, RTFBadHeader, CLASSIC)
md5 2885bbb18db2fc076e129a10729faadb
sha256 d98f2e4d241244265a3618366e4e9079314fc4b8235c599423d2f57dabd0e0c7
ssdeep 384:Hj6LzOUvQ4POHjI+4yHQVGjzL+ByYs/+1Pm4n:D6L66qjXlHzL+ByYb04n
imphash
impfuzzy
  Network IP location

Signature (7cnts)

Level Description
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice Performs some HTTP requests
info One or more processes crashed

Rules (3cnts)

Level Name Description Collection
warning MS_RTF_Suspicious_documents Suspicious documents using RTF document OLE object binaries (upload)
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://toss.is/6*WW4F US Linode, LLC 45.33.42.226 clean
toss.is US Linode, LLC 45.33.42.226 clean
45.33.42.226 US Linode, LLC 45.33.42.226 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure