Emotet — Office (OOXML) / .DOCX malware analysis

Static analysis result for SHA-256 8d3de338b1f13c55…

MALICIOUS

Office (OOXML) / .DOCX

319.5 KB Created: 2019-09-19 13:05:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: 12c0a3f94e87c9c4baa70e63cbb8f132 SHA-1: 219588d23f281f1fafad61780c115e1f61c7cd52 SHA-256: 8d3de338b1f13c55c73461a24fef506de8733e392cd145cc3a6a843bab28ee3d
348 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is a DOCX file containing a VBA macro, specifically a Document_Open macro, which is a common delivery mechanism for Emotet. The macro uses CreateObject and ShellExecute API calls, indicating it attempts to execute external code. ClamAV signatures also confirm the Emotet family. The extracted artifacts 'macros.bas' and 'vbaProject_00.bin' are directly associated with the malicious VBA project.

Heuristics 10

  • ClamAV: Doc.Trojan.Emotet-7171821-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Emotet-7171821-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://miraigroupsumatera.com/wp-includes/wkcw90205/
    • https://kaaryathalo.com/wp-content/231/
    • http://schemas.openxmlformats.org/package/2006/content-types
    • http://schemas.openxmlformats.org/package/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties
    • http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument
    • http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.openxmlformats.org/drawingml/2006/picture
    • http://schemas.microsoft.com/office/drawing/2010/main
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/fontTable
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
    • http://schemas.microsoft.com/office/2006/relationships/vbaProject
    • http://schemas.microsoft.com/office/2007/relationships/hdphoto
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/image
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships/webSettings
    • http://schemas.microsoft.com/office/thememl/2012/main
    • http://schemas.microsoft.com/office/2006/relationships/wordVbaData
    • http://schemas.openxmlformats.org/schemaLibrary/2006/main
    • http://schemas.microsoft.com/office/word
    • http://schemas.openxmlformats.org/package/2006/metadata/core-properties
    • http://purl.org/dc/elements/1.1/
    +5 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0a56672a6e9a1d7ccdc9ba37855892a954412e44f93bd74b95db397d840d3cd5		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 7149 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.
vbaProject_00.bin
31a369cdbcf6f433d2f69ff99986d9f63eb09ef62087b1e4a31663f5427ebe17		 vba-project OOXML VBA project: word/vbaProject.bin 64000 bytes
Detection
ClamAV: Doc.Trojan.Emotet-7171821-0
Obfuscation or payload: likely
Carved artifact contains 3 shell/COM execution token(s). Carved artifact contains 5 eval/decoder/string-building token(s). Carved artifact contains 37 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.