Emotet — Office (OLE) malware analysis

Heuristics 8

• ClamAV: Win.Trojan.Emotet-6397178-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Emotet-6397178-0
• VBA macros detected medium 2 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  EQzdr = XYESUiECDnb + iiNBKTBqq + imjUSk + XRDDcZR + HNRUmSG + bqYthhvGqw + kDWiGSfal + MijdrqsTdt + OrikVI + VmlXJvlfz + FwwMK
  VBA.Shell$ EQzdr, 0
  End Sub

• Auto_Close macro low OLE_VBA_AUTOCLOSE
  Auto_Close macro
  Matched line in script

  End Sub
  Sub AutoClose()
  XujqfnKhR

• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.