Emotet — Office (OOXML) / .DOCX malware analysis

Static analysis result for SHA-256 b876900fc5037786…

MALICIOUS

Office (OOXML) / .DOCX

135.6 KB Created: 2020-01-24 14:35:00 UTC Authoring application: Microsoft Office Word 16.0000
MD5: fb7e7ec78505fb14cb20ac4ef58e5717 SHA-1: d8c0f5dbd8bde516e2f97dc7d70c1b151d54f576 SHA-256: b876900fc503778678180d9503b47290be3a4d028a091ca0bba9411b99b14ce5
220 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Doc.Dropper.Emotet-7560778-0. It contains a VBA project with a Document_Open macro, which is a common technique for Emotet to execute malicious code upon opening the document. The GetObject call heuristic further supports the execution of external code. The primary function of this dropper appears to be downloading and executing a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Dropper.Emotet-7560778-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Emotet-7560778-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains vbaProject.bin — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas
    • http://schemas.microsoft.com/office/drawing/2014/chartex
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
    • http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/9/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/10/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/11/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/12/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/13/chartex
    • http://schemas.microsoft.com/office/drawing/2016/5/14/chartex
    • http://schemas.openxmlformats.org/markup-compatibility/2006
    • http://schemas.microsoft.com/office/drawing/2016/ink
    • http://schemas.microsoft.com/office/drawing/2017/model3d
    • http://schemas.openxmlformats.org/officeDocument/2006/relationships
    • http://schemas.openxmlformats.org/officeDocument/2006/math
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
    • http://schemas.openxmlformats.org/wordprocessingml/2006/main
    • http://schemas.microsoft.com/office/word/2010/wordml
    • http://schemas.microsoft.com/office/word/2012/wordml
    • http://schemas.microsoft.com/office/word/2018/wordml/cex
    • http://schemas.microsoft.com/office/word/2016/wordml/cid
    • http://schemas.microsoft.com/office/word/2018/wordml
    • http://schemas.microsoft.com/office/word/2015/wordml/symex
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroup
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInk
    • http://schemas.microsoft.com/office/word/2006/wordml
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShape

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0904cf2871be7e0d7557290bfef177a70e58432b7189693326ab66fa6153b7bc		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 16259 bytes
vbaProject_00.bin
7841760ff72474175669f625f35e306c81e27c3955ecd12236a3ae7293694371		 vba-project OOXML VBA project: word/vbaProject.bin 113664 bytes
Detection
ClamAV: Doc.Dropper.Emotet-7560778-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.