Microsoft Office Information.doc.rtf

Classification: Malicious

Microsoft Office Information.doc.rtf is an exploit (text/rtf). Detected by 21 antivirus engines. Linked to Uroburos malware.

Detection summary

  • 21 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: UROBUROS (S0022)

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Snake ThreatFox Abuse.ch 2025-02-20 09:38:52 2025-02-22 09:35:43 G0010 Turla S0022 Uroburos
Spyware VM-Ray 2022-11-16 20:24:35 2022-11-16 20:24:35
Keylogger VM-Ray 2022-11-16 20:24:35 2022-11-16 20:24:35
Downloader VM-Ray 2022-11-16 20:24:35 2022-11-16 20:24:35
Exploit VM-Ray 2022-11-16 20:24:35 2022-11-16 20:24:35

Tags

win.snake ekans snakehose

Sample information

Filenames
Microsoft Office Information.doc.rtf
File type
text/rtf
SHA-256
12adf2447a7a0290eaa584df416a5289abc98e5dd339ff801aa8cb9ec44883e2
First indexed
2022-11-16 10:38:42
Last updated
2026-09-30 20:19:19

Antivirus detections

EngineDetection
LionicTrojan.MSOffice.CVE-2018-0802.4!c
CAT-QuickHealExp.RTF.Obfus.Gen
SymantecExp.CVE-2017-11882!g1
AvastOther:Malware-gen [Trj]
KasperskyHEUR:Exploit.MSOffice.CVE-2018-0802.gen
TACHYONTrojan-Exploit/RTF.CVE-2018-0798
DrWebExploit.CVE-2018-0798.4
TrendMicroHEUR_RTFMALFORM
McAfee-GW-EditionBehavesLike.Trojan.mq
SophosTroj/RTFDl-CJA
GDataScript.Trojan.Agent.0IOV5P
GridinsoftSpy.U.Gen.bot
ZoneAlarmHEUR:Exploit.MSOffice.CVE-2018-0802.gen
MicrosoftExploit:O97M/CVE-2017-11882.ALE!MTB
GoogleDetected
AhnLab-V3OLE/Cve-2018-0798.Gen
McAfeeRTFObfustream.c!2C06040A14C4
ZonerProbably Heur.RTFObfuscation
IkarusExploit.CVE-2017-11882
FortinetRTF/CVE_2017_11882.BOR!Exploit
AVGOther:Malware-gen [Trj]