MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1204.002 Malicious File
The sample is identified as malicious by ClamAV with the signature 'Xls.Downloader.Emotet-a5251d3d2d6d3722-9951020-0', indicating it belongs to the Emotet family. Critical heuristics confirm the presence of Excel 4.0 macro sheets and the use of dangerous XLM formula APIs like FORMULA, CALL, and EXEC, which are capable of executing arbitrary code. The embedded XLM macros appear to be constructing commands and potentially downloading additional payloads, a common characteristic of Emotet droppers.
Heuristics 5
-
Excel 4.0 macro sheet (7 sheet(s)) critical OOXML_XLM_MACROSHEETMalformed OOXML local headers contain an Excel 4.0 (XLM) macro sheet. XLM was a major Office malware vector during 2020-2022 and is rarely used in modern legitimate workbooks.
-
Dangerous XLM formula APIs: FORMULA critical OOXML_XLM_DANGEROUS_FNExcel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA).
-
ClamAV: Xls.Downloader.Emotet-a5251d3d2d6d3722-9951020-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Downloader.Emotet-a5251d3d2d6d3722-9951020-0
-
Malformed OOXML package with recoverable local headers low OOXML_MALFORMED_ZIP_LOCAL_HEADERSThe OOXML ZIP central directory is invalid or missing, but local file headers expose a recoverable Office package. This can create parser divergence between tolerant Office/ZIP readers and scanners that rely only on the central directory.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6
Extracted artifacts 7
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_07.xml845190ff95687dd3bed60f8155a4703d187c9ac3d57c95b5f1e5fbccfcda8bf1 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml | 3818 bytes |
xlm_sheet_08.xml17a44bab46f03e771bd6542298156e3f6d09e434efc242a62b869dfb808c8fe0 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1339 bytes |
xlm_sheet_09.xmle0e53f2efa6401d85f42fc271b8a5f25f093236955ae9e2f8aff086ade287b72 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet2.xml | 1334 bytes |
xlm_sheet_10.xml99c0021f265b2512c81119e70583856c3b88d92cfcf4088dd76957bd454698ca |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet3.xml | 1337 bytes |
xlm_sheet_11.xml505da860283599ae30bb243e4b86ce81f7bcbf678c783ee47ffef058c21fdfa5 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet4.xml | 1341 bytes |
xlm_sheet_12.xml33833c2bb127cd3da704c0fa39beca9ede4ef247ba80706d40a7c8cb5fdddbee |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet5.xml | 1256 bytes |
xlm_sheet_13.xml9db93655cb6fd9e30bf1d3ffbd4e22d858cd95d48236de02bbc820699d35abf8 |
xlm-macrosheet | Malformed OOXML XLM macro sheet: xl/macrosheets/sheet6.xml | 1177 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.