Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 58a777a710434061…

MALICIOUS

Office (OOXML) / .XLSX

209.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 4435b75a49ae49b7b86209cbaa437ab1 SHA-1: a29e1262138c0a44e96074b2768d54f2d1f8e3be SHA-256: 58a777a710434061910e4488c781918fc298bbe766d7301f151568e291100666
180 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as an Excel 4.0 macro-enabled document, a common delivery mechanism for Emotet. The presence of multiple XLM macro sheets indicates the execution of embedded macros. The ClamAV detection explicitly names 'Xls.Downloader.Emotet-OOXML_XL', confirming the family and its downloader functionality. The macros are likely responsible for fetching and executing a secondary payload.

Heuristics 3

  • Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
a600c06266bbd0dd2b61dfcd96dbddd020e5f170c3c38b6dcb6601e0a598335b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 322 bytes
xlm_sheet_01.bin
68be8c00857b18185ff0efb8ce0fc7dee973358028087aac0391f0de04fd7463		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2194 bytes
xlm_sheet_02.bin
831006bd0c553b0a91e53049f365208dac45a8febf71d9228e851897dfadc0a7		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 477 bytes
xlm_sheet_03.bin
c21656b2108164807026268f3c90e971984d43f78f4ad8d0629615e7c816fd1b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.bin 428 bytes
xlm_sheet_04.bin
4c84712dfb6cbb1c894d2e20e88ae297988dcebbb5983e8d204a6eb35559433d		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.bin 428 bytes
xlm_sheet_05.bin
e98ba1032156b96d449962420d43c5579d2546bcffa300550b5879a220ba52cf		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet5.bin 428 bytes
xlm_sheet_06.bin
9d333dba9a33ad9b51bb0f6d0a215f0d5b3a70c36bd3f94c58bf82af3f604595		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet6.bin 428 bytes
xlm_sheet_07.bin
897e1d866cde58047a18fa0a80b9cfd322c031317c3ed7767f4a8fa4facff84c		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet7.bin 428 bytes
xlm_sheet_08.bin
27d5fabe81e784fe70f5c731c1f56cde57615c49df63f803f4d10f289dc491e8		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet8.bin 428 bytes
xlm_sheet_09.bin
afdc61e17960ec6f9ed7ed69d731a47414b0ad9e84008649fb89ebf19cc5bca0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet9.bin 348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.