Emotet — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 0dd37db0ef8d00d4…

MALICIOUS

Office (OLE) / .XLS

95.0 KB Created: 2015-06-05 18:19:34 Authoring application: Microsoft Excel First seen: 2022-07-05
MD5: f839f1c4a53e9d1dec3e37c1b52cb2b2 SHA-1: 0f34c209491e9dec5a00b48bb98e84492521762c SHA-256: 0dd37db0ef8d00d417f55218eb11aff0c87e15e057fe7862fee79d02192aa5d0
200 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Excel file containing Excel 4.0 (XLM) macros, specifically an Auto_Open macro. This macro utilizes dangerous formula APIs, including the RUN function, indicating an intent to execute external code. ClamAV detection confirms this as an Emotet downloader variant, which typically downloads and executes a second-stage payload.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • ClamAV: Xls.Downloader.Emotet-ea81817e7f807ab1-9952142-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-ea81817e7f807ab1-9952142-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
63d75723b700f36d4377a66abd3aca986ec95a2d1ebc10754b4e480389a60db6		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 8138 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.