RTF static analysis report

Static analysis result for SHA-256 51060e2ca64dfc0b…

CLEAN

RTF

225.9 KB Created: 2009-12-13 17:38:00 First seen: 2014-04-29
MD5: a666c55cd1200db5e7594f8900b1cc70 SHA-1: b0e6894560cef186218cd03a38d0c13c7a771b40 SHA-256: 51060e2ca64dfc0b6d87e74123ee1ca0374970c643ce7bbf80b3ff4e850a558f
22 Risk Score

Heuristics 2

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://usetermassembly/dealbuilder_live/DealBuilderNET/dealbuilder.aspx In RTF body
    • http://usetermassembly/dealbuilder_live/DealBuilderNET/dealbuilder.aspx}{In RTF body
    • http://schemas.microsoft.com/office/word/2003/wordmlIn RTF body
🗂 Part of campaign: usetermassembly 13 samples