Loading... Additional Content is being loaded
Windows Analysis Report SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.15350.12171
Overview
General Information
| Sample Name: | SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.15350.12171 (renamed file extension from 12171 to rtf) |
| Analysis ID: | 532961 |
| MD5: | bdacb3b17f31a06a8cfbedba2342bdf5 |
| SHA1: | 9f6930782942ec4bedc162be334b97f861d24f75 |
| SHA256: | 16fc1ecc295f8d7dba6647b9aeb8d538932910b24f3affe1853a82ab2c9d944a |
| Tags: | rtf |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
FormBook
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Document contains OLE streams which likely are hidden ActiveX objects
Sigma detected: Office product drops script at suspicious location
System process connects to network (likely due to code injection or exploit)
Document exploit detected (creates forbidden files)
Antivirus detection for dropped file
Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Droppers Exploiting CVE-2017-11882
Maps a DLL or memory area into another process
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Script Execution From Temp Folder
Document contains OLE streams with names of living off the land binaries
Creates processes via WMI
Performs DNS queries to domains with low reputation
Found potential equation exploit (CVE-2017-11882)
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Sigma detected: WScript or CScript Dropper
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Sample uses process hollowing technique
Writes to foreign memory regions
Sigma detected: Microsoft Office Product Spawning Windows Shell
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Very long command line found
Microsoft Office drops suspicious files
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Found suspicious RTF objects
Antivirus or Machine Learning detection for unpacked file
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Document contains Microsoft Equation 3.0 OLE entries
Enables debug privileges
Office Equation Editor has been started
Creates a window with clipboard capturing capabilities
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
AV Detection: |
  |
|---|
| Antivirus detection for dropped file |
| Source: |
Avira: |
||
| Found malware configuration |
| Source: |
Malware Configuration Extractor: |
||
| Yara detected FormBook |
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
Exploits: |
|
|---|
| Found potential equation exploit (CVE-2017-11882) |
| Source: |
Static RTF information: |
||
| Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) |
| Source: |
Process created: |
|||
| Source: |
Process created: |
Jump to behavior | ||
| Document contains Microsoft Equation 3.0 OLE entries |
| Source: |
Stream path '_1699986732/\x1CompObj' : |
||
| Office Equation Editor has been started |
| Source: |
Process created: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
HTTPS traffic detected: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
File opened: |
Jump to behavior | ||
Software Vulnerabilities: |
|
|---|
| Document exploit detected (creates forbidden files) |
| Source: |
File created: |
Jump to behavior | ||
| Potential document exploit detected (unknown TCP traffic) |
| Source: |
TCP traffic: |
||
| Potential document exploit detected (performs DNS queries) |
| Source: |
DNS query: |
||
| Potential document exploit detected (performs HTTP gets) |
| Source: |
TCP traffic: |
||
Networking: |
|
|---|
| Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) |
| Source: |
Snort IDS: |
||
| Source: |
Snort IDS: |
||
| Source: |
Snort IDS: |
||
| System process connects to network (likely due to code injection or exploit) |
| Source: |
Domain query: |
|||
| Source: |
Network Connect: |
Jump to behavior | ||
| Source: |
Domain query: |
|||
| Source: |
Domain query: |
|||
| Source: |
Network Connect: |
Jump to behavior | ||
| Source: |
Network Connect: |
Jump to behavior | ||
| Performs DNS queries to domains with low reputation |
| Source: |
DNS query: |
||
| C2 URLs / IPs found in malware configuration |
| Source: |
URLs: |
||
| JA3 SSL client fingerprint seen in connection with other malware |
| Source: |
JA3 fingerprint: |
||
| HTTP GET or POST without a user agent |
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Uses a known web browser user agent for HTTP communication |
| Source: |
HTTP traffic detected: |
||
| Internet Provider seen in connection with other malware |
| Source: |
ASN Name: |
||
| Source: |
ASN Name: |
||
| Source: |
ASN Name: |
||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Source: |
IP Address: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
File created: |
Jump to behavior | ||
| Source: |
DNS traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
Network traffic detected: |
||
| Source: |
HTTP traffic detected: | ||