SUSP_Doc_RTF_OLE2Link_Jun22

Rule Info

Av Ratio
44.35
Score
75
Name
SUSP_Doc_RTF_OLE2Link_Jun22
Minimum Yara
3.2.0
Required Modules
[]
Description
Detects a suspicious pattern in RTF files which downloads external resources
Reference
Internal Research
Date
2022-06-01
Tags
['DEMO', 'SUSP', 'FILE']
Rule Hash
f8fb814d680f13e351116438c79e85d4
Author
Christian Burkard

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
98
Suspicious (< 10 engines)
1
Clean (0 engines)
0

Rule Matches

Positives
Hash
Total
Timestamp
VT
22
761aebae43e63e0bc13df15a97830148f402b86a48953500c96900d04658487c
57
2022-06-17 07:36:17
24
3ebdf4404107dc59fc0d675850fbc66ccd0d5f3dc2db588dee1a382032a11e4f
57
2022-06-17 06:55:07
20
62bb38dd4f9dbedcfea802ffe27e3ae63dd0881320dda6deb2a44d25521dba19
56
2022-06-17 00:03:23
27
0d20207bb504c3dfdcc15d6dde0786c2e9bbd5dab907431b985194876a4d0079
56
2022-06-16 17:35:36
26
ac9258a7bcdb150043efb9b5ddd6208db4d118e1c6ab36183d2db462d231c85c
55
2022-06-16 13:14:53
25
b12345991f90a15fc1aab2064f26a09d979b5db2cb6729a2a09674b2acaea4f6
57
2022-06-15 06:10:50
25
21084e011386665e1847989eeb607efda0315145e8370ebf5174e865725c3dfb
57
2022-06-14 13:01:57
37
32061862303c9d73c7a15d9725d27478bd583edba79ca549b33d014d38e56e48
56
2022-06-13 15:18:01
30
e4e6232751b0107fc33e7cfd8daad597bc64b1a140963d23c8565f6ccc6b9fe2
56
2022-06-13 10:27:40
30
7791196606328fcc8b02401b236b650d078dc5693029df1bae3c50a9c4c9607d
57
2022-06-13 10:18:55
36
17dfd3747821deb1c89a829c88593764a3a2097fcdb23824c21ef48f66e961ef
57
2022-06-13 09:46:42
35
1b622bd463172f4fddfb0250d647de796f25487d9fe23e0343bfda64720283a6
56
2022-06-13 09:46:42
19
db625382ab165526f3c0afb4a8ba51f134b06e7ee67ecc84436b942423d84909
56
2022-06-13 00:57:51
19
b7be86c8bcacb5a0f5b8904a82bba5e6be0b02b1599332389a8afc4167221de1
56
2022-06-12 23:07:20
18
a32cb65a9b9714af85eea15329a6954ba69d67209d8409ad591f4892fba972a0
55
2022-06-12 22:49:12
27
286b859c81975cf9511423d8f5b752ef0fe9178d0b0ede3992264327f457e27b
57
2022-06-12 22:15:07
27
4f7f5b100fe4805c876b5b40be9eca19dce04337a060146bbd54308ed4d624f7
56
2022-06-12 21:54:52
28
a53c0cef1a76fa5abaa61143433b717096ea2e94e5deed7ebd29a09121cc0b9d
56
2022-06-12 21:51:42
24
fa83c1a745e9e0fecc4d75f50eafd15a3a3f3f197a015f63dc0e2ad050a1d3ee
57
2022-06-12 17:07:18
27
de8568763f338130032c5f62eda974182ed20c1809a5f04b3b939f84ba41caa3
57
2022-06-11 14:57:39
28
0f9dba053d177c0c31bf5d58e80b49dfa2384df38399254567bf0f81530a4abf
57
2022-06-11 02:15:00
21
4e122561819889c70ef83dcf8d957b3667326338e1f7e98973f040b34c588672
57
2022-06-11 01:29:06
11
1a90d2ee137d1007f246b7e5acdb730ae00d9c5ab5beb871578a0d5d18e84eb8
56
2022-06-10 22:57:54
21
f2877615ab392075f90e6d9857729423ac0a9dc6443353bb36996b08f9d12102
57
2022-06-10 22:41:28
36
1087216420b8bf4de391b97980690dd0f7439f5a90e4c40513ad8fa4f5a4b4fd
56
2022-06-10 18:22:12
26
22250ce8b2b728b4e28c5b156a3ee61120b9c575f593b9d7edca4374200b1340
57
2022-06-10 18:21:08
22
25c35d3ef86c9cbfef1bf0944d06354e942d474de309864b6cc139c1050504d0
56
2022-06-10 15:38:27
36
2cd00158eb897fc12c064848839d1cd2e3f6699575809a4e90554caa333a1db6
57
2022-06-10 13:10:44
28
fd975def2758e37f1f1ac2a84236847d12fabc504baab2b6d19bb68734242ce6
57
2022-06-10 11:33:44
27
40818ecc12f85fab31e85a36b852bba9f89caf2ee120a4daab8a182f31f5b912
56
2022-06-10 11:29:02
21
0128790340ea9633ca4708c3cb3f24e6ac229d124774fba49158f06fa277a65d
57
2022-06-09 13:51:18
28
3c541f5c7ddf2cc7a5178789c5ca9d9c28e84ad812d3c2492537e6c938aeb4a6
57
2022-06-09 13:41:32
23
5f4a7f7c5688448ff2e2dcb68686e48d443a0432490241535c5e90d11aefd066
56
2022-06-09 11:48:27
29
f023e71a6e3cf52a47b2510cffc66a3c3229336a5b40f34c0237ba259cbad06e
57
2022-06-08 23:31:51
8
b010abfad07f790cfd370fdc3483a967ef78e533a0c5316a685c90fbbb8fb902
56
2022-06-08 17:26:26
21
7b6aa46f13cb6a22aaf2087a0d175faa54f00f146d0b1604d9add1b749a43fcc
57
2022-06-08 13:46:05
36
13d0d0b67c8e881e858ae8cbece32ee464775b33a9ffcec6bff4dd3085dbb575
56
2022-06-08 13:12:53
36
b3b3cac20d93f097b20731511a3adec923f5e806e1987c5713d840e335e55b66
57
2022-06-08 13:10:53
24
66d8c3dc8e7ba420abc173995247885cb9d175dc315324074ed2ddd569122813
57
2022-06-08 12:01:06
36
ced7ca9625543d3d3d09f70223cc19f0d99e21792854452df5ba84b3a59d17b8
57
2022-06-08 02:15:44
36
25693aedc3a99633e88c6b8f89a7bffa5d931144c239a5caf6c23aa85736f9e6
56
2022-06-08 02:15:42
35
6f6ee01e9dc2d8c4c260ef4131fe88dc152e53ee8afd3e66e92d4e1bf5fd2e92
57
2022-06-08 02:15:41
27
7641c3d8e2a5159333fb99a851ac8c400bb7fd62fc61c58e6016747045cab0c1
55
2022-06-08 00:29:10
21
a7e524e2f0f516eff4d3cb91c7f9ce708fefbfa920fa7ad156018b075bad5399
57
2022-06-07 16:27:05
20
e740a4698c01e0bd1f048f84f27656f4fb7fa6ead1413fa69d8a90303e31bc8a
57
2022-06-07 16:24:39
20
8bac38def883c8d31f30e0590aae072c0d2c7c8ec546a231b3d10cdef2812e7c
57
2022-06-07 16:23:25
19
3d5b7b9584371e5949124caf05848d76e259462eb28b39dae47954239e32cb80
57
2022-06-07 16:16:17
19
8d4788337d4aaa4b69dedd19346605cbc3490d27d0aa5090a0626660dd4025fa
56
2022-06-07 16:15:11
19
bbe0d4de10229454cea56a37482715801b17be6ee84f422c13d9bcc55bff5eb6
56
2022-06-07 16:14:07
19
ebf691e7f508dc7c50b5971b74a5ca7d3b7334581aca981246568acdfc64962c
57
2022-06-07 16:11:57
20
e03b9edded9084e1e9afe55233c93482171dfbd719d40f993b5aa4f90e4fae36
56
2022-06-07 15:30:57
22
cb4c28313790bbef09c401ae03d1a317a4febceec72981b855c044f2c58dabfb
57
2022-06-07 14:54:28
24
ae5aa4ba75bbde7758e0cd213ef1b90b7b5ccb3e8662b8901fd865bb3b28460a
57
2022-06-07 13:32:03
27
cdf1515d97941b2a99cc56ab314a931f26afe2e3dc0cadd5b24f5ac0283a6050
57
2022-06-06 22:02:40
25
9d5468ddddf1828c642392bfa12acd9cb892f95d3eccc789d87fc0068aa77af0
57
2022-06-06 20:39:17
26
d326852cbe6574471990b85e164a4ed8f42010b1c2258ff07dbebd40f7193c71
56
2022-06-06 20:35:27
27
e080e547c6c65286f2c52362771df5d13aeeb3d18d1057634c76481d5f025393
56
2022-06-06 20:27:06
26
680b9a7a47e9a7b843497e5af3eea8cad8fd1b68b014e939cf0718c23f4caf90
57
2022-06-06 20:21:31
25
563406c42e6ecf3fe3093438f1736a93f3d54fcc671cd06f4ac2a488b68ca091
57
2022-06-06 20:09:54
25
ec92ecf966585e83a1aa93f22f5ae1d4d4ce77036662f232bf8546b081e36cfe
57
2022-06-06 20:05:27
25
824f43812fa0e47f45f4b3a8aaa93ffdf1516448ad7bd25fb127a670bf4b1369
56
2022-06-06 19:59:43
23
0180b1a87b71083c55a6ce3accfcbcc2cdb113cb904ea81ae8077ed0f1925da3
57
2022-06-06 19:56:03
23
0ea0d62dcd2a968920ad3440bf72dcc397b091950a615925662b20713bdab366
57
2022-06-06 19:52:47
23
f08a2b82a8ce15d101f157c891f1d2921e67c6f3f8dc39654a98bf22769e4980
56
2022-06-06 19:49:37
23
3a64b60d00e4f13319504766d0c49641a08c3b475219dcd74767d1a0a88ffc86
56
2022-06-06 19:46:27
23
e26d3469558163be2b73383603c1192d7993a419cda7e1b7fa051b1ea42a9bd0
56
2022-06-06 19:46:26
23
c54f3d4fe5e3290adf3ca72b0908f7d71975fdd44ccecf6a6254ff7b1e2e06f4
57
2022-06-06 19:44:17
23
f4266687e1bcd02771d7a2162059f5c81e0298bd4151fc739fbaa2886bb59b51
57
2022-06-06 19:33:34
24
038276cb9c77684c17b7ed8d473874afb7f432d4755e9f3f7b6e1379b93ab55c
56
2022-06-06 19:27:56
22
2b96851ad15aaec7545d34569ed8f052f867b9b920a64ac11de45665c7fee011
57
2022-06-06 19:22:49
23
ec22dcb2d6eb88a20c70a332a145964768db58d488f9cf0811c4e958fd3f223e
57
2022-06-06 19:12:41
20
4b4cdaca6170174a808dcfe8af383d87b4fe67b0eee8b7d4b42498f557884459
56
2022-06-06 18:38:14
25
15bb7656a65e3969b41c82d4c18487db55c54ee700446187e3605f93c91b1ff1
56
2022-06-06 16:07:46
23
a55fa03cbe8f7bb0fb6071d9ac918070d1cc170cee1922b192bd62234983d836
57
2022-06-06 09:47:33
25
ed830e8265339f7333eb8dac6b65a6216d9dbbca67d4c98467f561be39fffcdd
57
2022-06-06 02:53:13
20
59b97e177bb4e8f0b29d090548f9843db082620439ee51e8214f69317731978a
57
2022-06-05 12:16:23
17
9879d1fe3efc3bfe2d0915cadb0d0b8ce1cb5971a4bcb8db888b6f2db31e846a
39
2022-06-05 01:02:47
23
597b2d742b140ed7a36dd4303d3cf6f2ba69c768232a195e1a37ded55e38d640
57
2022-06-04 11:04:26
25
0efe61bed9a208cfed32f196e4f4ec13060ec6e185b364fc148bc6a0f808f842
58
2022-06-03 23:42:38
26
d9d32cc03cd04e5b2bd3f1158424451b253880d139c0309e13170f353d1ab51a
57
2022-06-03 23:20:05
25
6d5afbda4b8c89ab426bcacb91485fd7a91b6b0a1e6f935fd3771ff709751395
58
2022-06-03 20:09:50
23
dd19cbc60fe06a43c01b86100e232932da12d3155aba729bc9d978a6d14dc25d
58
2022-06-03 19:49:57
24
ddc4c5a2e0542cb809e955925f7692939e0f745e78ee0c808cb91f26b4809bd6
58
2022-06-03 19:41:57
26
1ac31a1c7ed86e42033592e607a4563b279d203b701427992672280bb0bcd5c5
58
2022-06-03 18:42:01
23
24b02931086fc7e35837bcbde51db72f1568734218dffc0ecb24fdbf21374d3e
57
2022-06-03 18:17:50
29
8e57e4b2766c22732f776e4f401bc174cbc55c7b3f93c3e76790709019fc8ba2
57
2022-06-03 09:04:32
41
b807b93fbe9f39477d875c269bab1325e97672f467ce16cd6e10d2f1f6d4f071
58
2022-06-03 08:04:12
22
59c7344258e78b8650cae2745d821710dff6ed82c8bcd9e23c6d842c76d62d3a
58
2022-06-03 07:13:40
29
0877f9624e4be84da68681f86207d99a68951d5e9605663752ed6908f796c665
59
2022-06-03 06:10:01
29
4c21e6013a814b78b9f1f86930a0b834e675ce6f8f6c61c6123014387aa53087
58
2022-06-03 04:50:10
25
1384e9ecfbd07a456d435646a3b2b966388318e3581d5efd2371d202951e5e65
58
2022-06-03 04:27:26
26
ca7e9c65fd2cec62110b50581529198c43b7982820a38c912baa81d0294b8126
58
2022-06-03 01:10:41
24
f8d4e5924183fdd1ad36358e2f66d6cff8c250c8783b28ec486f3574406540d4
58
2022-06-02 20:31:08
24
2847081f418ab503ff6a84ccc26662ec2cfe14a2ffae5ca3929672ba1d3ce68b
57
2022-06-02 19:20:14
24
8cf20c0343c4141a402c8fed4397fd3a6da3a2d4f61e23eed3f5b720191fdede
59
2022-06-02 18:54:14
26
533106d2eebfbb7a40f2c92b72d0ac526d5c6244e94e43084d23c6623a220847
57
2022-06-02 17:07:57
24
eff173b7ec379652c33ec4ad6a02809d740d4a1e71f8da1b0b9e1ecb7e9c87a6
58
2022-06-02 17:07:12
29
98bb0c920210694516041659aca988ea167036d080680f4a7ccac3e233bc4b83
57
2022-06-02 11:17:38
29
e8f0a2f79a91587f1d961d6668792e74985624d652c7b47cc87367cb1b451adf
58
2022-06-02 11:06:48

Rule Matches per Month (last 24 months)