Win.Trojan.Emotet-6397178-0 — Office (OLE) malware analysis

Heuristics 7

• ClamAV: Win.Trojan.Emotet-6397178-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Emotet-6397178-0
• VBA macros detected medium 2 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  jpBrTMNBoS = OTsFR + SVlLFWE + jdPQJCLLJj + UzRjzHF + rIrss + kosDdT + TlFQhtHJZCz + fGPwzhr
  VBA.Shell$ jpBrTMNBoS, 0
  End Sub

• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  End Sub
  Sub AutoOpen()
  EVjpGsLdH

• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.