Emotet — Office (OOXML) / .XLSX malware analysis

Heuristics 7

• ClamAV: Xls.Downloader.EmotetExcel02221-9938627-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Downloader.EmotetExcel02221-9938627-0
• Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
  Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
• Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
  Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
• Dangerous XLM formula APIs: FORMULA, RETURN critical OOXML_XLM_DANGEROUS_FN
  Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
  Excel workbook contains 4 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://arzulens.com/wp-includes/7gySgTg/ In macro / runtime command snippet

  • https://www.swaong.com/wp-admin/k9Db4Vjafnk/In document text (OOXML body / shared strings)
  • https://simplinteriors.com/wp-admin/B1e/In document text (OOXML body / shared strings)
  • http://68bets.site/b/bL2bq71qNY/In document text (OOXML body / shared strings)
  • https://farocf.com/wp-admin/rX9FcCxf0Cf4bj/In document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.