SUSP_Doc_RTF_OLE2Link_Jun22

Rule Info

Author
Christian Burkard
Reference
Internal Research
Minimum Yara
3.2.0
Name
SUSP_Doc_RTF_OLE2Link_Jun22
Date
2022-06-01
Description
Detects a suspicious pattern in RTF files which downloads external resources
Tags
['FILE', 'DEMO', 'SUSP']
Score
75
Av Ratio
47.24
Required Modules
[]
Rule Hash
f8fb814d680f13e351116438c79e85d4

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
151
Suspicious (< 10 engines)
2
Clean (0 engines)
0

Rule Matches

Hash
Positives
Total
Timestamp
VT
09472d6340b1ea8a888e2b33fb6e084bf9bacede6f726688ae0a0e804199e61e
38
61
2022-11-27 08:11:11
9a2650b060e118a2c9ed5af432262828f19282eb13f81e951baca278b1c8ebc2
38
61
2022-11-27 07:14:16
9b320d2d22ad46f8d2dc581adab099225c0ce1523b2556e6ae8eededb062b705
26
61
2022-11-25 14:29:27
cf0e6de99a2711182945fef1633dbc6481d5a24a80aae882157f9d27bd2c28f7
26
61
2022-11-25 13:36:59
fd05411aa5a76824f4df547d21cdedaa088bdaef0929c38520d467e9df3e0878
27
61
2022-11-25 13:22:34
d04f9b3baf7e416296fb6ae6b08355cb81550bb6b23b35d4f77982dbcd266e75
26
61
2022-11-25 12:55:50
b6e37d60cc98e755a74bce33534566194e14ec32f07067a5849d7a64af2177b8
28
61
2022-11-24 10:30:15
fb10367ed2ef6e90f770845b67bc60607dc087bfce8f26ea7375aeaa9bd119b3
20
61
2022-11-21 18:46:20
71858482689deb1f8e42b80d433ce08783fe02269e5593ab1a3b7acd44ae1a21
41
60
2022-11-19 03:21:05
69d5e3678d8c497714c2c711f09833efd5c8377aabb5365238fc230e1afb6607
21
61
2022-11-17 06:16:18
4e8a2457d393613f25ad69d2a2407edccb0f4c8ff8f7848c92c6bb74e0479485
23
61
2022-11-17 06:15:14
dfc1ef46e7287e55161cb300900d5bc2a92272f0226270c6d25514fa2b9b0cff
23
61
2022-11-17 06:12:01
9bddd7fab6cc0f4bc81595a9e6eb17cf46fe3b0cb8267c98a3985907fea88710
22
61
2022-11-17 06:10:57
f1f9e9877762a18dcc42dad94c525c38d8816c83dc8c1190e66110f9a8253647
22
61
2022-11-17 04:44:56
2d36315125fa113e2ec4bbed01c2752fe2a5798d0284999c2e2935b395b8a33e
22
61
2022-11-17 04:40:05
42648972268c521af090750c719eca7f61cf26adae7b5d0abf390ad0a452d0f0
29
61
2022-11-16 01:10:55
83bf66d838b5f2be0a898a1a60dc13a0da683ae20d304b3384d3c0850bd4ad81
48
72
2022-11-15 22:26:15
5f66881fa0e6c14f69de7fdd1832e46151dde523a1ad76c7a7ab4250e412e853
45
68
2022-11-15 20:56:56
a80fdb1c1a358cf32a122f6cad3e5190a60804ecc163f75f50840ba29f119475
42
61
2022-11-09 16:36:21
a80cc55187d1434fa165fb317c3ee35ac55e707acd7af851304699f2d4b02f5d
39
61
2022-11-07 13:10:28
34230801855c49ab1b8967452ce2935f18f917fbfe547c4136916de9b4f8b722
23
61
2022-11-06 15:11:00
7e2d10ec19bc5ab5906795bd6539cadedc24013fe8951521c42376d0ca1b7260
39
61
2022-11-03 14:29:45
1e64a67b9116e359b125f944471953690e1b76493f02da925e63fdec6ba8a46f
18
60
2022-10-28 13:13:34
cc4568ff258091d7f3af23f531e10ebfe2f57b5f63a80364af751366ed8cf27e
51
72
2022-10-26 01:42:37
c1ba99c3edd62d9ad6b08adde89008e8f9775c198b438318ca93f5d6fd725131
40
61
2022-10-23 08:54:25
d87241f56d44c7f028f8931bf72c75338eef7d84bbc8a73f035417a37c2517ac
36
61
2022-10-22 09:53:02
c827b1fa836ed4903ad41ee4507b329aaba30275f5b9e7e7f0d699cf9be3adb0
39
61
2022-10-21 16:38:18
9c256bb4cdc25ce5f9880d894c148262173eabc813d6618c9df5c12bbc1baf5b
25
61
2022-10-16 07:47:56
37cde05b0d4782d80da62b854cceeed1c7ea60228bc12ce9fc0dffe1939bcc16
28
61
2022-10-08 13:42:32
c9f55f3db9b0d104da906ed9dfc2e1441776654d563f62c3af859a6ba73ed207
41
61
2022-10-07 15:01:43
a9bbbf5e4797d90d579b2cf6f9d61443dff82ead9d9ffd10f3c31b686ccf81ab
41
61
2022-10-04 17:53:53
76e7ce4ab6d520f0717bb0dea8ff6973e1f7c6ea39f7138a5eb5d5483fd21e21
27
60
2022-10-04 07:31:56
e66cd1b9228b7839b69672f4a28cff67010b96d391c25a240b902ef5dc60b640
27
60
2022-10-01 23:09:15
54b02876a502e597382adc0633be8028e4788373586ffbbac37bd57621c7a7a7
40
60
2022-09-29 07:09:44
ecff20c73939355c0acf977aefab8ac694babcdd557462bb18f8464f0e47e3fb
36
61
2022-09-29 05:05:51
37ec2f402cc5dd94fe331a2b038a69783b2af02c869b8d03a7d913c090d97e3c
32
61
2022-09-28 13:12:02
31f7ec45e18735476452520fbc0d0a72d3706e25da4805925fed7e5ed6e87708
39
60
2022-09-19 12:33:34
ae48d23e39bf4619881b5c4dd2712b8fabd4f8bd6beb0ae167647995ba68100e
40
60
2022-09-19 09:16:04
33b77459b3b88949e2110f81c77c5024f2701a5bfa580f275da9b8f2316c2c73
39
60
2022-09-16 17:55:10
ec7d5db1267ca7fffb9a873b77c06c718d094445f0cf60655ef88343d338a658
26
60
2022-09-09 12:20:28
9e7497be92a3eca2b7a48a0cc758d524ff462721dfd072f9385d37633e5c3cbe
29
60
2022-09-07 11:14:50
5a97d9023ff4df5fd16f4fba20f22ae3872a7e4dd75af8320816d1c2c8b3d6c0
31
59
2022-09-07 11:12:51
b5781ec6e68a41b62efca9e2c88c19e0e94b3652f3216e7e84f079408484eeef
27
59
2022-09-07 11:12:48
ff357f6e196e04d7bc04d3e53bcb68c99e2b4c4b832aa79ef884d44746572d7b
29
60
2022-09-07 11:10:13
6cfca8bab830368c96bd0131a36d2ec8affb88ffb0ec519df1dea7f5e0651dd0
30
59
2022-09-07 10:15:12
b1bed8c98a4766bad9164df477afe26eb810f49c52f5fd659de91078ac425b74
38
58
2022-09-02 07:13:27
c98f34e4e87f041c3f19749bbb995bfcd2e3de20c2ba619ea4a0ed616ac1b629
42
59
2022-08-31 20:13:02
155d016e372148a6043906d91095bcc8652550a11e266e84c0e1d3dce1bbe178
39
59
2022-08-29 11:19:25
4249955de0029e91ae3d8dae947597ec96c5f3e8d9b15e0c009c6ac22ade3e95
38
60
2022-08-29 09:01:35
ef225b60e211abfa64899a009dc31f88ce40337861984626fc533adaf85cd5fe
33
60
2022-08-29 09:00:21
df05710fcb0ca111c9edc55cff78ca3c61bd5b5dec0a8f9c769aaf934f2d8de5
2
62
2022-08-29 07:45:00
55a2814820d20cb84f5161212355b476cc4a3ff445b257ff24370ed8a6a5bee4
39
60
2022-08-26 13:17:32
1572b4b8a3a082e53e10e1f6e24fd18c5ffc2a33b2e2af35487123f125084160
25
60
2022-08-21 15:22:53
4ee669a3762dc47688e61682b314c16a32e88374a7dd68610835919b936dfde3
39
60
2022-08-19 07:18:41
761aebae43e63e0bc13df15a97830148f402b86a48953500c96900d04658487c
22
57
2022-06-17 07:36:17
3ebdf4404107dc59fc0d675850fbc66ccd0d5f3dc2db588dee1a382032a11e4f
24
57
2022-06-17 06:55:07
62bb38dd4f9dbedcfea802ffe27e3ae63dd0881320dda6deb2a44d25521dba19
20
56
2022-06-17 00:03:23
0d20207bb504c3dfdcc15d6dde0786c2e9bbd5dab907431b985194876a4d0079
27
56
2022-06-16 17:35:36
ac9258a7bcdb150043efb9b5ddd6208db4d118e1c6ab36183d2db462d231c85c
26
55
2022-06-16 13:14:53
b12345991f90a15fc1aab2064f26a09d979b5db2cb6729a2a09674b2acaea4f6
25
57
2022-06-15 06:10:50
21084e011386665e1847989eeb607efda0315145e8370ebf5174e865725c3dfb
25
57
2022-06-14 13:01:57
32061862303c9d73c7a15d9725d27478bd583edba79ca549b33d014d38e56e48
37
56
2022-06-13 15:18:01
e4e6232751b0107fc33e7cfd8daad597bc64b1a140963d23c8565f6ccc6b9fe2
30
56
2022-06-13 10:27:40
7791196606328fcc8b02401b236b650d078dc5693029df1bae3c50a9c4c9607d
30
57
2022-06-13 10:18:55
1b622bd463172f4fddfb0250d647de796f25487d9fe23e0343bfda64720283a6
35
56
2022-06-13 09:46:42
17dfd3747821deb1c89a829c88593764a3a2097fcdb23824c21ef48f66e961ef
36
57
2022-06-13 09:46:42
db625382ab165526f3c0afb4a8ba51f134b06e7ee67ecc84436b942423d84909
19
56
2022-06-13 00:57:51
b7be86c8bcacb5a0f5b8904a82bba5e6be0b02b1599332389a8afc4167221de1
19
56
2022-06-12 23:07:20
a32cb65a9b9714af85eea15329a6954ba69d67209d8409ad591f4892fba972a0
18
55
2022-06-12 22:49:12
286b859c81975cf9511423d8f5b752ef0fe9178d0b0ede3992264327f457e27b
27
57
2022-06-12 22:15:07
4f7f5b100fe4805c876b5b40be9eca19dce04337a060146bbd54308ed4d624f7
27
56
2022-06-12 21:54:52
a53c0cef1a76fa5abaa61143433b717096ea2e94e5deed7ebd29a09121cc0b9d
28
56
2022-06-12 21:51:42
fa83c1a745e9e0fecc4d75f50eafd15a3a3f3f197a015f63dc0e2ad050a1d3ee
24
57
2022-06-12 17:07:18
de8568763f338130032c5f62eda974182ed20c1809a5f04b3b939f84ba41caa3
27
57
2022-06-11 14:57:39
0f9dba053d177c0c31bf5d58e80b49dfa2384df38399254567bf0f81530a4abf
28
57
2022-06-11 02:15:00
4e122561819889c70ef83dcf8d957b3667326338e1f7e98973f040b34c588672
21
57
2022-06-11 01:29:06
1a90d2ee137d1007f246b7e5acdb730ae00d9c5ab5beb871578a0d5d18e84eb8
11
56
2022-06-10 22:57:54
f2877615ab392075f90e6d9857729423ac0a9dc6443353bb36996b08f9d12102
21
57
2022-06-10 22:41:28
1087216420b8bf4de391b97980690dd0f7439f5a90e4c40513ad8fa4f5a4b4fd
36
56
2022-06-10 18:22:12
22250ce8b2b728b4e28c5b156a3ee61120b9c575f593b9d7edca4374200b1340
26
57
2022-06-10 18:21:08
25c35d3ef86c9cbfef1bf0944d06354e942d474de309864b6cc139c1050504d0
22
56
2022-06-10 15:38:27
2cd00158eb897fc12c064848839d1cd2e3f6699575809a4e90554caa333a1db6
36
57
2022-06-10 13:10:44
fd975def2758e37f1f1ac2a84236847d12fabc504baab2b6d19bb68734242ce6
28
57
2022-06-10 11:33:44
40818ecc12f85fab31e85a36b852bba9f89caf2ee120a4daab8a182f31f5b912
27
56
2022-06-10 11:29:02
0128790340ea9633ca4708c3cb3f24e6ac229d124774fba49158f06fa277a65d
21
57
2022-06-09 13:51:18
3c541f5c7ddf2cc7a5178789c5ca9d9c28e84ad812d3c2492537e6c938aeb4a6
28
57
2022-06-09 13:41:32
5f4a7f7c5688448ff2e2dcb68686e48d443a0432490241535c5e90d11aefd066
23
56
2022-06-09 11:48:27
f023e71a6e3cf52a47b2510cffc66a3c3229336a5b40f34c0237ba259cbad06e
29
57
2022-06-08 23:31:51
b010abfad07f790cfd370fdc3483a967ef78e533a0c5316a685c90fbbb8fb902
8
56
2022-06-08 17:26:26
7b6aa46f13cb6a22aaf2087a0d175faa54f00f146d0b1604d9add1b749a43fcc
21
57
2022-06-08 13:46:05
13d0d0b67c8e881e858ae8cbece32ee464775b33a9ffcec6bff4dd3085dbb575
36
56
2022-06-08 13:12:53
b3b3cac20d93f097b20731511a3adec923f5e806e1987c5713d840e335e55b66
36
57
2022-06-08 13:10:53
66d8c3dc8e7ba420abc173995247885cb9d175dc315324074ed2ddd569122813
24
57
2022-06-08 12:01:06
ced7ca9625543d3d3d09f70223cc19f0d99e21792854452df5ba84b3a59d17b8
36
57
2022-06-08 02:15:44
25693aedc3a99633e88c6b8f89a7bffa5d931144c239a5caf6c23aa85736f9e6
36
56
2022-06-08 02:15:42
6f6ee01e9dc2d8c4c260ef4131fe88dc152e53ee8afd3e66e92d4e1bf5fd2e92
35
57
2022-06-08 02:15:41
7641c3d8e2a5159333fb99a851ac8c400bb7fd62fc61c58e6016747045cab0c1
27
55
2022-06-08 00:29:10
a7e524e2f0f516eff4d3cb91c7f9ce708fefbfa920fa7ad156018b075bad5399
21
57
2022-06-07 16:27:05
e740a4698c01e0bd1f048f84f27656f4fb7fa6ead1413fa69d8a90303e31bc8a
20
57
2022-06-07 16:24:39
8bac38def883c8d31f30e0590aae072c0d2c7c8ec546a231b3d10cdef2812e7c
20
57
2022-06-07 16:23:25
3d5b7b9584371e5949124caf05848d76e259462eb28b39dae47954239e32cb80
19
57
2022-06-07 16:16:17
8d4788337d4aaa4b69dedd19346605cbc3490d27d0aa5090a0626660dd4025fa
19
56
2022-06-07 16:15:11
bbe0d4de10229454cea56a37482715801b17be6ee84f422c13d9bcc55bff5eb6
19
56
2022-06-07 16:14:07
ebf691e7f508dc7c50b5971b74a5ca7d3b7334581aca981246568acdfc64962c
19
57
2022-06-07 16:11:57
e03b9edded9084e1e9afe55233c93482171dfbd719d40f993b5aa4f90e4fae36
20
56
2022-06-07 15:30:57
cb4c28313790bbef09c401ae03d1a317a4febceec72981b855c044f2c58dabfb
22
57
2022-06-07 14:54:28
ae5aa4ba75bbde7758e0cd213ef1b90b7b5ccb3e8662b8901fd865bb3b28460a
24
57
2022-06-07 13:32:03
cdf1515d97941b2a99cc56ab314a931f26afe2e3dc0cadd5b24f5ac0283a6050
27
57
2022-06-06 22:02:40
9d5468ddddf1828c642392bfa12acd9cb892f95d3eccc789d87fc0068aa77af0
25
57
2022-06-06 20:39:17
d326852cbe6574471990b85e164a4ed8f42010b1c2258ff07dbebd40f7193c71
26
56
2022-06-06 20:35:27
e080e547c6c65286f2c52362771df5d13aeeb3d18d1057634c76481d5f025393
27
56
2022-06-06 20:27:06
680b9a7a47e9a7b843497e5af3eea8cad8fd1b68b014e939cf0718c23f4caf90
26
57
2022-06-06 20:21:31
563406c42e6ecf3fe3093438f1736a93f3d54fcc671cd06f4ac2a488b68ca091
25
57
2022-06-06 20:09:54
ec92ecf966585e83a1aa93f22f5ae1d4d4ce77036662f232bf8546b081e36cfe
25
57
2022-06-06 20:05:27
824f43812fa0e47f45f4b3a8aaa93ffdf1516448ad7bd25fb127a670bf4b1369
25
56
2022-06-06 19:59:43
0180b1a87b71083c55a6ce3accfcbcc2cdb113cb904ea81ae8077ed0f1925da3
23
57
2022-06-06 19:56:03
0ea0d62dcd2a968920ad3440bf72dcc397b091950a615925662b20713bdab366
23
57
2022-06-06 19:52:47
f08a2b82a8ce15d101f157c891f1d2921e67c6f3f8dc39654a98bf22769e4980
23
56
2022-06-06 19:49:37
3a64b60d00e4f13319504766d0c49641a08c3b475219dcd74767d1a0a88ffc86
23
56
2022-06-06 19:46:27
e26d3469558163be2b73383603c1192d7993a419cda7e1b7fa051b1ea42a9bd0
23
56
2022-06-06 19:46:26
c54f3d4fe5e3290adf3ca72b0908f7d71975fdd44ccecf6a6254ff7b1e2e06f4
23
57
2022-06-06 19:44:17
f4266687e1bcd02771d7a2162059f5c81e0298bd4151fc739fbaa2886bb59b51
23
57
2022-06-06 19:33:34
038276cb9c77684c17b7ed8d473874afb7f432d4755e9f3f7b6e1379b93ab55c
24
56
2022-06-06 19:27:56
2b96851ad15aaec7545d34569ed8f052f867b9b920a64ac11de45665c7fee011
22
57
2022-06-06 19:22:49
ec22dcb2d6eb88a20c70a332a145964768db58d488f9cf0811c4e958fd3f223e
23
57
2022-06-06 19:12:41
4b4cdaca6170174a808dcfe8af383d87b4fe67b0eee8b7d4b42498f557884459
20
56
2022-06-06 18:38:14
15bb7656a65e3969b41c82d4c18487db55c54ee700446187e3605f93c91b1ff1
25
56
2022-06-06 16:07:46
a55fa03cbe8f7bb0fb6071d9ac918070d1cc170cee1922b192bd62234983d836
23
57
2022-06-06 09:47:33
ed830e8265339f7333eb8dac6b65a6216d9dbbca67d4c98467f561be39fffcdd
25
57
2022-06-06 02:53:13
59b97e177bb4e8f0b29d090548f9843db082620439ee51e8214f69317731978a
20
57
2022-06-05 12:16:23
9879d1fe3efc3bfe2d0915cadb0d0b8ce1cb5971a4bcb8db888b6f2db31e846a
17
39
2022-06-05 01:02:47
597b2d742b140ed7a36dd4303d3cf6f2ba69c768232a195e1a37ded55e38d640
23
57
2022-06-04 11:04:26
0efe61bed9a208cfed32f196e4f4ec13060ec6e185b364fc148bc6a0f808f842
25
58
2022-06-03 23:42:38
d9d32cc03cd04e5b2bd3f1158424451b253880d139c0309e13170f353d1ab51a
26
57
2022-06-03 23:20:05
6d5afbda4b8c89ab426bcacb91485fd7a91b6b0a1e6f935fd3771ff709751395
25
58
2022-06-03 20:09:50
dd19cbc60fe06a43c01b86100e232932da12d3155aba729bc9d978a6d14dc25d
23
58
2022-06-03 19:49:57
ddc4c5a2e0542cb809e955925f7692939e0f745e78ee0c808cb91f26b4809bd6
24
58
2022-06-03 19:41:57
1ac31a1c7ed86e42033592e607a4563b279d203b701427992672280bb0bcd5c5
26
58
2022-06-03 18:42:01
24b02931086fc7e35837bcbde51db72f1568734218dffc0ecb24fdbf21374d3e
23
57
2022-06-03 18:17:50
8e57e4b2766c22732f776e4f401bc174cbc55c7b3f93c3e76790709019fc8ba2
29
57
2022-06-03 09:04:32
b807b93fbe9f39477d875c269bab1325e97672f467ce16cd6e10d2f1f6d4f071
41
58
2022-06-03 08:04:12
59c7344258e78b8650cae2745d821710dff6ed82c8bcd9e23c6d842c76d62d3a
22
58
2022-06-03 07:13:40
0877f9624e4be84da68681f86207d99a68951d5e9605663752ed6908f796c665
29
59
2022-06-03 06:10:01
4c21e6013a814b78b9f1f86930a0b834e675ce6f8f6c61c6123014387aa53087
29
58
2022-06-03 04:50:10
1384e9ecfbd07a456d435646a3b2b966388318e3581d5efd2371d202951e5e65
25
58
2022-06-03 04:27:26
ca7e9c65fd2cec62110b50581529198c43b7982820a38c912baa81d0294b8126
26
58
2022-06-03 01:10:41
f8d4e5924183fdd1ad36358e2f66d6cff8c250c8783b28ec486f3574406540d4
24
58
2022-06-02 20:31:08
2847081f418ab503ff6a84ccc26662ec2cfe14a2ffae5ca3929672ba1d3ce68b
24
57
2022-06-02 19:20:14
8cf20c0343c4141a402c8fed4397fd3a6da3a2d4f61e23eed3f5b720191fdede
24
59
2022-06-02 18:54:14
533106d2eebfbb7a40f2c92b72d0ac526d5c6244e94e43084d23c6623a220847
26
57
2022-06-02 17:07:57
eff173b7ec379652c33ec4ad6a02809d740d4a1e71f8da1b0b9e1ecb7e9c87a6
24
58
2022-06-02 17:07:12
98bb0c920210694516041659aca988ea167036d080680f4a7ccac3e233bc4b83
29
57
2022-06-02 11:17:38
e8f0a2f79a91587f1d961d6668792e74985624d652c7b47cc87367cb1b451adf
29
58
2022-06-02 11:06:48

Rule Matches per Month (last 24 months)