Emotet Office (OOXML) / .XLSX malware analysis — malicious · 1fc6bed3f1f9a035

MALICIOUS

Office (OOXML) / .XLSX

58.6 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-06-30

MD5: f391b6abfa46df66449a0446f80d4168 SHA-1: ef875d0ed399227b6a549c150f2d7f881096f303 SHA-256: 1fc6bed3f1f9a03513cff88ce3d523852565812a75874800add07b4a2efe870b

280 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.002 Spearphishing with Other Weapons

The file is an OOXML XLSX document containing a VBA project. Heuristics indicate a Workbook_Open macro is present and uses CreateObject to execute VBA p-code, a common pattern for Emotet. The ClamAV signature also explicitly identifies it as an Emotet downloader. The VBA code is truncated but the presence of auto-execution and CreateObject strongly suggests it's designed to download and run a secondary payload.

Heuristics 7

ClamAV: Xls.Downloader.Emotet-adc2d23d2dc26dd0-9950240-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Emotet-adc2d23d2dc26dd0-9950240-0
NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f91d968e7aede40e47325a6246a166c00bf77af134d05b7bffc894d7fbafe992`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	5791 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `6d3678c4868118759de0e1dc0de49ffab3ead0b7bafca8c94455b3e576ed427c`	vba-project	OOXML VBA project: xl/vbaProject.bin	13312 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`emf_00.emf` `9af05940505f74ef4b9014ce487de32dfdc5a256efc9a4dd6e29fd04cd507bef`	ooxml-emf	OOXML EMF part: xl/media/image1.emf	1272 bytes
`emf_01.emf` `1f3c67b7776842439a9b7b8dbd1faaf5abe7506ad01c69ae575be3ecb83cdcef`	ooxml-emf	OOXML EMF part: xl/media/image2.emf	372 bytes
`emf_02.emf` `92987bc81add0d6d4a3134301cc6fdcc7dec9b7d75f444fee965378bfcd47e75`	ooxml-emf	OOXML EMF part: xl/media/image4.emf	1272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.