Emotet Office (OLE) / .DOC malware analysis — malicious · 4054a4f314849369

MALICIOUS

Office (OLE) / .DOC

110.0 KB Created: 2021-11-24 10:11:00 Authoring application: Microsoft Office Word

MD5: 4f194c3ac26cda75bbea1bac2409a6ce SHA-1: 146e24f998720febe6354124f5b0446511e0fb1b SHA-256: 4054a4f314849369670235f1c40d35d15de7252d8d88d21fe66e5faabdcbf495

182 Risk Score

Malware Insights

Emotet · confidence 85%

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 User Execution: Malicious File T1105 Ingress Tool Transfer

ClamAV detection specifically identifies this as EmotetRedDawn. The VBA macro in the Document_Close event triggers a call to a function that passes a highly obfuscated string containing a possible URL or command. The critical heuristic for Shell() calls indicates the system is executing external commands to download and execute a second-stage payload.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Doc.Downloader.EmotetRedDawn11210-9912806-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.EmotetRedDawn11210-9912806-0
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `519a3f5cf0943f79bc5f5b30d9569856b8a6f18cd1f79034acfa0b29053c666d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3215 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.