Emotet Office (OLE) malware analysis — malicious · cf7a86f7ad7ac9e2

MALICIOUS

Office (OLE)

71.5 KB Created: 2018-11-06 07:12:00 Authoring application: Microsoft Office Word First seen: 2019-09-30

MD5: 3c38ec0b95a2dfd769571996ca9fe339 SHA-1: 052e358eacefab9cdd1d416a4d71e1ce35b2adb8 SHA-256: cf7a86f7ad7ac9e26f6ad03b397b1ceab1e35b2a9ce717c7563f00c507046652

142 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file was detected as Emotet by ClamAV. Heuristics indicate the presence of PowerShell commands and LOLBin usage within the document body. The obfuscated PowerShell script reconstructs a Base64 encoded string, which is then decoded and executed, likely to download and run a second-stage payload. This behavior is consistent with Emotet's typical infection chain.

Heuristics 4

ClamAV: Doc.Dropper.Emotet-6769504-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Emotet-6769504-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.