Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 1f35faec99c228a0…

MALICIOUS

Office (OOXML) / .XLSX

209.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: bebeff98f1e6b59aec1c7fb580b229fb SHA-1: 9b81d1f82509b08a25c2bd8b77ec48b51fab6c18 SHA-256: 1f35faec99c228a02cb0c505349a087f0bafc94bf24aee41cea5e95af16c26d2
180 Risk Score

Malware Insights

Emotet · confidence 85%

MITRE ATT&CK
T1204.002 User Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic for Applications T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell

The sample is an XLSX file containing multiple hidden Excel 4.0 macro sheets (XLM), a technique often used to bypass traditional VBA macro detection. The ClamAV detection specifically identifies this as Xls.Downloader.Emotet, and the structural evidence of multiple binary macro sheets is consistent with Emotet's delivery mechanism. No readable scripts were extracted due to the binary nature of the binary macro sheets, but the heuristic firings and antivirus detection provide high confidence in the attribution.

Heuristics 3

  • Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
a600c06266bbd0dd2b61dfcd96dbddd020e5f170c3c38b6dcb6601e0a598335b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 322 bytes
xlm_sheet_01.bin
68be8c00857b18185ff0efb8ce0fc7dee973358028087aac0391f0de04fd7463		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2194 bytes
xlm_sheet_02.bin
831006bd0c553b0a91e53049f365208dac45a8febf71d9228e851897dfadc0a7		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 477 bytes
xlm_sheet_03.bin
c21656b2108164807026268f3c90e971984d43f78f4ad8d0629615e7c816fd1b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.bin 428 bytes
xlm_sheet_04.bin
4c84712dfb6cbb1c894d2e20e88ae297988dcebbb5983e8d204a6eb35559433d		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.bin 428 bytes
xlm_sheet_05.bin
e98ba1032156b96d449962420d43c5579d2546bcffa300550b5879a220ba52cf		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet5.bin 428 bytes
xlm_sheet_06.bin
9d333dba9a33ad9b51bb0f6d0a215f0d5b3a70c36bd3f94c58bf82af3f604595		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet6.bin 428 bytes
xlm_sheet_07.bin
897e1d866cde58047a18fa0a80b9cfd322c031317c3ed7767f4a8fa4facff84c		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet7.bin 428 bytes
xlm_sheet_08.bin
27d5fabe81e784fe70f5c731c1f56cde57615c49df63f803f4d10f289dc491e8		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet8.bin 428 bytes
xlm_sheet_09.bin
afdc61e17960ec6f9ed7ed69d731a47414b0ad9e84008649fb89ebf19cc5bca0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet9.bin 348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.