Emotet Office (OLE) malware analysis — malicious · 1e3b05a828387111

MALICIOUS

Office (OLE)

66.8 KB Created: 2018-11-06 07:12:00 Authoring application: Microsoft Office Word First seen: 2019-01-11

MD5: 84edcc87da575c69f2fac0b50178fa42 SHA-1: 17f35c2ba73d85341a8feddeba34472da52ef3ff SHA-256: 1e3b05a8283871117192d73f0730efbaaa7aeef23b0e0cad957a6eefef4bd3f9

142 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file was detected as Emotet by ClamAV. Heuristics indicate the presence of PowerShell commands and LOLBin usage within the document body. The obfuscated PowerShell script reconstructs a Base64 encoded string, which is then decoded and executed, likely to download and run a second-stage payload. This behavior is consistent with Emotet's typical infection chain.

Heuristics 4

ClamAV: Doc.Dropper.Emotet-6769504-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Emotet-6769504-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.