Report - ...............dot

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2024.03.31 04:00 Machine s1_win7_x6401
Filename ...............dot
Type ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
AI Score Not founds Behavior Score
4.2
ZERO API file : mailcious
VT API (file) 40 detected (CVE-2017-1188, CVE2017, ObfsObjDat, Camelot, multiple detections, Obfuscated, Malicious, score, dinbqn, Siggen3, RTFMALFORM, RtfExp, Detected, Malform, Probably Heur, RTFBadHeader, Qgil, ARicher, bSxJ5m, ai score=84)
md5 d553bd422c8d3621e21049ccc2ebe680
sha256 6450d0e98420f1c3eabb0a545516d7a048aa9dd698255d43c92e5182efb4f841
ssdeep 192:nRI15seTBQgHvHeGuuwEc4jc8pcpQveJf81AFflrkCkH3lm8u2:RI1PTKqvHeGuuw/4jcG2QGU1OxkCkVF9
imphash
impfuzzy
  Network IP location

Signature (7cnts)

Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates hidden or system file
info One or more processes crashed

Rules (3cnts)

Level Name Description Collection
warning MS_RTF_Suspicious_documents Suspicious documents using RTF document OLE object binaries (upload)
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
103.125.191.125 VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP 103.125.191.125 1 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure