Report - simplethingseverywherehappeningwithgreatthingstobeonlinewithgreatattitudeandentirethingsgreat_______wenicetogetmebackwithnew.doc

MS_RTF_Obfuscation_Objects RTF File doc
ScreenShot
Created 2024.07.24 09:13 Machine s1_win7_x6403
Filename simplethingseverywherehappeningwithgreatthingstobeonlinewithgreatattitudeandentirethingsgreat_______wenicetogetmebackwithnew.doc
Type Rich Text Format data, version 1, unknown character set
AI Score Not founds Behavior Score
4.6
ZERO API file : mailcious
VT API (file) 37 detected (ObfsObjDat, Save, CVE-2017-1188, multiple detections, RTFObfustream, Obfuscated, Malicious, score, dinbqn, CLASSIC, Malformed, RTFMALFORM, RtfExp, Detected, twnbk, Camelot, Malform, Probably Heur, RTFObfuscation, Edhl, ai score=83)
md5 adfee8b962087fe5108f615806ce6903
sha256 0ff105df6495ddf66c6517261123c11119d2ad4433df36f9414106a7af3fe411
ssdeep 768:wFLj+SsP8LlTPhAqL75DymPL6AxfzWVWgK5D:wtsELlTPh3L7FDPW0fz0oD
imphash
impfuzzy
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 37 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice An application raised an exception which may be indicative of an exploit crash
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice RTF file has an unknown character set
info One or more processes crashed

Rules (2cnts)

Level Name Description Collection
warning SUSP_INDICATOR_RTF_MalVer_Objects Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. binaries (upload)
info Rich_Text_Format_Zero Rich Text Format Signature Zero binaries (upload)

Network (7cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://46.183.222.11/938/simpleweightcreatednicething.gIF LV DataClub S.A. 46.183.222.11 mailcious
http://198.46.176.133/Upload/vbs.jpeg US AS-COLOCROSSING 198.46.176.133 41176 mailcious
https://pastecode.dev/raw/6l7qjjrz/paste1.txt Unknown 172.66.43.27 41177 mailcious
pastecode.dev Unknown 172.66.40.229 mailcious
46.183.222.11 LV DataClub S.A. 46.183.222.11 mailcious
172.66.43.27 Unknown 172.66.43.27 mailcious
198.46.176.133 US AS-COLOCROSSING 198.46.176.133 mailcious

Suricata ids



Similarity measure (PE file only) - Checking for service failure