EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23

Rule Info

Name
EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23
Author
delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl
Description
Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)
Score
75
Date
2023-03-15
Modified
2023-03-18
Minimum Yara
3.2.0
Rule Hash
5a7b49a00235a75679a12da9936d289d
Tags
['CVE_2023_23397', 'SUSP', 'FILE', 'EXPLOIT', 'T1020', 'DEMO']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
23
Suspicious (< 10 engines)
40
Clean (0 engines)
19

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-03-13 12:04:24
0
62
fc1dd1adc10a1220184b0710709347b25f0661e135d5b74c528a0eac1543a6e0
2024-03-13 11:24:40
0
62
91aac8b09109237b147ac35d48943a4d4835799c7fd7dc1791b10d5c7053d3d4
2024-03-13 11:16:55
0
62
63b31d844a12825696aa5cb13b27fe93c7e42a19296a1044e39cac63ace26944
2024-02-21 15:05:00
0
61
0391aab6ee57c96e17c999999e1ddc86f4e2985ac0cac41a95a33eaef8f6debc
2024-01-27 20:12:43
0
61
f0aadb46f003aded0b369b9fd6533cdc7f9e638283b36b063169f8da91bebba9
2023-11-21 16:37:49
11
60
cfc33d2a139d29d3bbacbb641d7814f842c29654aecc55aad7c20c41fca97654
2023-11-21 16:09:11
14
56
e81bdcc52f2a1cbd50cc9e7708f2627f249fe2e7e8441f38eaaac4f293c3088f
2023-10-10 15:03:02
13
61
9eec38bdf784a5a3e6d7c35e0117de975e2db688fc95713dc22b45ab9ab48275
2023-10-10 13:54:37
11
60
2d97f85fd8b9b74fbf28e9c913818e8610a2a335f04589e96b01091106484b1d
2023-09-12 10:06:57
6
60
da1b622a10989519d486fcf2c7b5859f2e8b9705068282a19cd4fb26ee5dd23e
2023-07-08 07:15:46
12
60
993a656951b30ab91584ce35da787939cdba83e473637e791cdd364ed5c48fcf
2023-07-08 07:08:50
13
60
448cf60dfbd1ded6f1f22c3c82ab9b3f81939d1d0673b315164f0c9b964d1ba7
2023-07-04 18:04:08
0
60
af3d7db07e2fd13ddfee3d609d25cfdba435c029ec880383f803104209c25fad
2023-06-20 10:38:37
13
60
15e7af9cc77fe9804160ec2ed0f6c8ada897da6e80ddc92e3a71e6fbe0630b9b
2023-05-23 15:10:18
14
59
5373c9d3b4a30c85a4700cd4579addf3a7eb49edc5122c59b4e780ea2c14d264
2023-04-21 23:18:45
17
60
71a3385e9c9f93e31c6ee5738a82fdd98cdcacff9dc77f18e38e44dab484c118
2023-04-12 12:13:04
13
59
38f7fd367a7b3578f18165b2a8a63952dadc997e998ae149ecdbc123bc596371
2023-04-07 17:15:31
13
60
e53a9d4c4c98b8a1a9cfc5124e1e08b3c37b3487038e20c5716d6e90a47fd82d
2023-04-06 21:48:59
13
60
91900ab03eda26694a4fe3c47b7a603ffd6e5be2d76bcd04de4bd46f6e49f3af
2023-04-03 21:09:58
1
60
dc0112db7d5e1d12b39692c6d9c4b3bc3913409a38f48c53e78937daa1a2c96e
2023-04-03 08:23:37
16
60
cc0df32d2bd0e46dcd775a5f4ae6a6e64d67c6228f5989f187b64cd7195c173b
2023-04-02 07:08:43
18
60
997d4b33a7b885270b7bcc617d77190b70af0a791d6eab98c69b1967dbf42074
2023-03-31 18:09:19
16
60
2658b55a59fefc8cc48f619756c400c52d0ae1ff1e979030b66201ecc365999f
2023-03-30 10:30:13
13
57
2cd0f30a29ea09802bc72ea953e885cc2c4274aa9e2153b76e18c62d613d1f8c
2023-03-29 20:51:34
13
60
fa5e8e0b918e4bff95ddf0a71e8f127404272240259b7700ef607d87ae0ff451
2023-03-29 16:07:25
16
59
61f59652d836dc5cc4df29398932de808d33c394d3a02ba472dca60da4088049
2023-03-29 12:50:52
15
58
cfaa3f0817ed7f17b5bd452829f112e4f6cedcdd86caa47edd47d4f625ebacf4
2023-03-29 08:23:31
13
60
e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02
2023-03-28 17:53:56
9
59
4cae1aa6b15e14f6311009600b72580c6491fca0eefc6ce23d0df0fce50fb067
2023-03-28 17:49:58
13
59
cf42d66df0cd704d5f695d55591cefa78c7ac64c0b741cd752f71ba161737e3d
2023-03-28 12:04:16
8
60
dc4219f217f4cc4dabf1d6e65e33202b141af76b978ff3631c58cff689221b83
2023-03-25 05:44:45
0
58
8c08d14b8813586a24fc1fb009c93f30e903cfb4f96c6285f398db813992d3cf
2023-03-24 20:35:27
12
59
f5790499a32d1769f830397e532bda03f8aa756f01b5b4d5007e2153fa3b76e4
2023-03-24 15:54:57
0
60
0e86aa318d98b2af9700c83e457768c5529e3951070753ce8f3fa7d4b5c05c61
2023-03-24 15:53:54
0
60
4753605c1a3c010097d47e6d08926534d1d0fd39fc348f57fcf441476025d444
2023-03-24 09:41:02
5
58
8b33b49138d6c2c602940162a991e6217369124bc82bec86799574e938b4f418
2023-03-24 04:22:07
2
60
8fdfe716f39236881117cd2ec1104c82ab682e0e49555c2353c44835d0f82d36
2023-03-24 01:55:50
2
60
c30e72172496c4f6dc7911205853f03b092e03b11c521ffc5833913fb6e4f288
2023-03-22 19:19:12
1
59
fb516a4905c6c47ffa725abf7916f5da0cea5b25bbb4e90f8b8ac1b5ca682e7a
2023-03-22 17:09:54
2
57
eb45ce5f53b91d3b479d86ee3607224b493750c051c6aaea0efe8c35f3386d28
2023-03-22 16:38:31
4
59
7c074489f47e76654abfc54321c6c4aa9443e4f607f9cb2dc6c5cfbe2bb18ffc
2023-03-22 16:37:14
6
59
798f599af7823531acec897506cb8e91db0f2e3768c0c21c9500481490f69740
2023-03-22 16:35:49
5
59
e765645fe48644646e3305f44e2db9f4e9f0b71f2dd28830f784e3a81177170d
2023-03-22 00:37:16
2
59
46e8b8a9095dbd3bcf1357ad7a1a9645f96ca229d04aaca4419a5faed28694fc
2023-03-21 14:18:05
4
59
089888384cefc0941a0088c8db7696dd77a22e66e01ecd164bf9101b599b141a
2023-03-21 13:09:06
6
60
89ba378281ea8544b17a0d41cf67a351a400a50e94c8e4d1206a6be82df44019
2023-03-21 03:37:35
0
59
e80156324c1c622995d1461d0afaf4053d0179036fba3de05c900a0e9d1cd965
2023-03-20 21:12:33
2
59
6574128ee1dcfacb7a7d25428f15f8f74302ade8f3b96de06cd6f6c2a8a20f8c
2023-03-20 18:40:49
1
59
6126e5de0d64e8b6da8e03c25b542a1d6a316413a8b364e3c9080f1ab10a2dec
2023-03-20 10:25:12
1
59
ed654baf42c0caaeb66d8a3d9a8fe05d0895bf69a84d4122c1732bf6857af31d
2023-03-20 10:02:10
3
59
03b1f2c30494bf557f0554c909e8e1d21e6f2a2502c86872525d0214fad6ce62
2023-03-20 06:23:28
2
60
d33b484c55d59490f4a490e3c02d5799fefd900bb5f42fc090c622171281f89d
2023-03-20 05:34:15
1
60
6fd24add32d42987ab1f8617109800b132ef12dc53e62a26630543303529de5d
2023-03-20 03:43:38
1
37
a4e13d564647b09a0966590005bc02d8121702e9dd35e956b9d6bad2024a411e
2023-03-18 10:05:03
1
59
770d642cd74678ec3880c6d88d1144bf009f9265bfe464cadc8034c0f6eaed67
2023-03-18 05:06:26
1
59
7d94c1946abe60549dd724309257095f96d4a41784e22e7fdd2821048e666151
2023-03-17 22:09:55
2
58
2986a00ce732edcd607f34f1c0fd37c3dfd4a249554d49c98fbc8a76368bcd09
2023-03-17 20:06:40
0
59
0eca265b0c7352353bd56837fdc2c2b6222f7cc2656c395dc28431c4b38576f9
2023-03-17 16:31:43
2
58
24d3449a950b72a1cb6a4aa7d0f05a77f990de99ffebaef2da8bea30a7437bc6
2023-03-17 13:50:03
0
59
07dd965b6f78dd3cf52542a9386f3421ec6b56c1eb5a8f139a7a67133390f595
2023-03-17 10:24:26
2
59
3f5db4a2387646ac3ec64b8476579f389f74c30ff483cfe51fb4ff1cc9cb4dda
2023-03-17 07:13:30
2
60
078b5023cae7bd784a84ec4ee8df305ee7825025265bf2ddc1f5238c3e432f5f
2023-03-17 06:26:13
4
59
562e40daf01ca6a8f397fed437abbd21bd33ffb8eedda2db3f2d6768b58b0444
2023-03-17 06:07:54
2
60
8ccc1c2bc251b7ebbe8ad001e9e9093bc29ebe8652c43b2f3cfc74bb53b10554
2023-03-17 06:04:33
4
60
626a1ac262c3f094f1bcf54de5af7c5b9693f9bf7af39d0af4928438af58a534
2023-03-17 06:02:16
2
60
cb8d3cce6f2722947ffa6cf195e5b93de39bfd79682f28377bd71a5b996b955b
2023-03-17 06:01:06
3
60
03a81e52235b2b5ffb182f437941e3605218c52fd14b55c208b07065d770a8ef
2023-03-17 05:59:58
2
60
7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad
2023-03-17 05:58:52
3
60
d544d82998bf9955610fe2b2163913c4ea4e6b51ef44e38fbe3f22d835ce58e5
2023-03-17 05:58:52
3
60
d4ef1b6b08a175a5401ff7e9c1837c78d327a056f480ae8b3553ef88d4965d47
2023-03-17 05:07:08
3
60
a034427fd8524fd62380c881c30b9ab483535974ddd567556692cffc206809d1
2023-03-17 04:36:56
14
60
582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf
2023-03-17 02:33:30
0
60
0cdf5501352ba4de05b35e5dd394b3d1529b36a658952389c959c44cf8872882
2023-03-17 01:43:57
1
60
eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa
2023-03-17 01:42:51
1
60
0db4e30fb89fa2a97af589d1db4e6e049f121424281f1550db1acca48a8ee479
2023-03-16 20:19:53
0
60
d440ae7072df94458a9da84ea3f91b03df4693f328066a80d18fead2c3125a16
2023-03-16 18:31:32
0
60
b33a0eb265d4679a429e9551b76e3ffbd5c4dca39ec50a6af1cda7c49fd14771
2023-03-16 17:34:50
0
60
7a029dcbf7c69edc3d234596f669b20b1fd45b20f310668314117403187d9ebb
2023-03-16 17:32:41
0
60
f46301802feb133b3a036cd020c982bdce7edc63dc6718e42e2756265dee01a7
2023-03-16 17:32:37
0
60
1e7767eaaa659a1ef8b8e00c0fbb94d0629016c6a92fa5ab1191b91ec83d19c8
2023-03-16 16:10:02
0
60
47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3
2023-03-16 16:07:40
1
60
6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909

Rule Matches per Month (last 24 months)