Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 61e89f51b42a0d7a…

MALICIOUS

Office (OOXML) / .XLSX

257.9 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-02-16
MD5: 0ca9d513addf0daf6174991a07d6bf65 SHA-1: 6e2fea6f6fbdb1aacd8c1c686b6c3a058d90b507 SHA-256: 61e89f51b42a0d7a466e92cb08bda621104ef677193678f60c9110c5e9583a8b
120 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file was detected as malicious by ClamAV with the signature 'Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0', indicating it is likely an Emotet downloader. The presence of Excel 4.0 macro sheets confirms the use of macros for execution. These macros are designed to download and execute a secondary payload, a common characteristic of Emotet.

Heuristics 2

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
7882e9bc1af9baf322c46fdf40ee697d3478a5e1340250d547de82a512dbe59b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2439 bytes
xlm_sheet_01.bin
86382bd657c1c4063683e9cb42624589f8aa1fc621f270bbb5041fb8508b304b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 484 bytes
xlm_sheet_02.bin
0a9fa880b5a7546c7b56783abe7e1c4298c1e8624103cd161e3dac9c5603a3f0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.