Emotet — Office (OLE) / .DOC malware analysis

Static analysis result for SHA-256 a559212086d1d1a3…

MALICIOUS

Office (OLE) / .DOC

185.5 KB Created: 2021-11-24 10:11:00 Authoring application: Microsoft Office Word
MD5: 089fa07b5a4a15143d37a1dc59d931e9 SHA-1: cee53295c465ab614cecfad7909ecad6e7fecdab SHA-256: a559212086d1d1a3b2ad64977500f034fe20c6122b57386fbeeecae8dfcfc531
122 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The sample is a malicious OLE document containing VBA macros. The macros execute obfuscated PowerShell commands that attempt to download and execute a second-stage payload from multiple URLs. The ClamAV detection name 'Doc.Downloader.EmotetRedDawn11210-9912807-0' strongly suggests an Emotet family attribution. The PowerShell commands reconstruct a list of URLs and a command to execute a downloaded DLL, indicating a downloader functionality.

Heuristics 4

  • ClamAV: Doc.Downloader.EmotetRedDawn11210-9912807-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.EmotetRedDawn11210-9912807-0
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e7b0f071ebb284c65a5c9630cb3ed746fc1c63014d254fb88606b3704aa4cf48		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 21048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.