Emotet Office (OLE) malware analysis — malicious · f987b24f3d9a98ac

MALICIOUS

Office (OLE)

72.1 KB Created: 2018-11-06 07:12:00 Authoring application: Microsoft Office Word First seen: 2019-01-12

MD5: d790feb4382e400ae348c510f67dcffd SHA-1: 2458730382f943a6f58b58f9065a1cca31232bee SHA-256: f987b24f3d9a98acf138c4a9f73cdf7b00fc0a239cb8d4d684e2f6cd9c02b7cf

142 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file was detected as Emotet by ClamAV. Heuristics indicate the presence of PowerShell commands and LOLBin usage within the document body. The obfuscated PowerShell script reconstructs a Base64 encoded string, which is then decoded and executed, likely to download and run a second-stage payload. This behavior is consistent with Emotet's typical infection chain.

Heuristics 4

ClamAV: Doc.Dropper.Emotet-6769504-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Emotet-6769504-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.