Emotet — Office (OOXML) / .XLSM malware analysis

Heuristics 7

• ClamAV: Xls.Downloader.Emotet03222-9941788-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Xls.Downloader.Emotet03222-9941788-0
• Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
  Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
• Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
  Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
• Dangerous XLM formula APIs: FORMULA critical OOXML_XLM_DANGEROUS_FN
  Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
  Excel workbook contains 5 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://www.aulavirtualapecc.com/server/qramDt1UIotz/ In macro / runtime command snippet

  • http://calzadoyuyin.com/cgj-bin/uzOOL/In document text (OOXML body / shared strings)
  • http://www.arkidecture.com/vendor/5Ibj6pmUm/In document text (OOXML body / shared strings)
  • https://www.berekethaber.com/dosyalar/2z6RZL/In document text (OOXML body / shared strings)
  • https://ingelse.net/Overview/slWIUhVtK/In document text (OOXML body / shared strings)
  • https://wimmergroup.com/home_tours/Pvnw2/In document text (OOXML body / shared strings)
  • http://bizztream.com/images/NS85wHTdIY9N5Ay/In document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
  • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
  • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Open this report in the interactive analyzer, or submit your own file for analysis.