Emotet — Office (OLE) / .DOC malware analysis

Static analysis result for SHA-256 ea299622bc9c5dde…

MALICIOUS

Office (OLE) / .DOC

185.5 KB Created: 2021-11-24 10:11:00 Authoring application: Microsoft Office Word
MD5: 03e990fa43abf9f10cb3ebc3ee95e904 SHA-1: c1f255cfb27fc002eb09add15076a51fc309b4fa SHA-256: ea299622bc9c5ddeb18ab322d2c8987989ae28c990ec5def7dbc33276de79cd6
122 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The ClamAV detection and the presence of VBA macros strongly suggest Emotet. The VBA script contains obfuscated PowerShell commands that reconstruct URLs and a DLL path. Specifically, it constructs the command 'cwgjamd /wgjac swgjatarwgjat/wgjaB' and uses 'Get-Random' to generate parts of a path, ultimately aiming to download and execute a payload from reconstructed URLs like 'http://thetrendsikil.com/wp-content/UH11/'. The script also attempts to execute a DLL using rundll32.exe.

Heuristics 4

  • ClamAV: Doc.Downloader.EmotetRedDawn11210-9912807-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.EmotetRedDawn11210-9912807-0
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e7b0f071ebb284c65a5c9630cb3ed746fc1c63014d254fb88606b3704aa4cf48		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 21048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.