Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 16e8d82f4634d746…

MALICIOUS

Office (OOXML) / .XLSX

251.0 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-02-28
MD5: 22742c483d1556f23690c1898148fd8a SHA-1: 62f434f4f3d65c5ec36e8b217a549b140994a43c SHA-256: 16e8d82f4634d7465d5c85038b9a2887376b2f9d6e05137458a429e194f746be
120 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV with the signature 'Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0', indicating it is likely an Emotet downloader. The critical heuristic 'OOXML_XLM_MACROSHEET' confirms the presence of Excel 4.0 macros, which are commonly used by Emotet to execute malicious code. These macros likely download and execute a secondary payload, consistent with Emotet's typical behavior.

Heuristics 2

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
217b976a1455d38cebc8bbf74bc13fc9a02ab2650105512004d338387d72a161		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2327 bytes
xlm_sheet_01.bin
0e373ab2ec31374e963ab69abd60915e474f90635ea55cbbed3537dc849e5b41		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 428 bytes
xlm_sheet_02.bin
bbb48aa334e3c48c0aeb3ba76da4d017bf3b3af8d04b19e3d22bb6a81512b412		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.