Emotet — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 6486f4730c2041aa…

MALICIOUS

Office (OLE) / .XLS

107.7 KB Created: 2022-01-22 10:28:51 Authoring application: Microsoft Excel
MD5: 1687db9a923f48cab5a32cdfc450b66f SHA-1: bea928fd72be2c9846d95f0a5c183e0b4f8a22b6 SHA-256: 6486f4730c2041aa4e8c96ecc214d10c1b014e958e85d01c2da7934b984fb42e
140 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains Excel 4.0 macros, specifically an Auto_Open entry, which is a strong indicator of malicious intent. ClamAV detection confirms this, identifying it as an Emotet downloader variant. The macro sheet's presence and the ClamAV signature strongly suggest this file is designed to download and execute a secondary payload, characteristic of Emotet's distribution methods.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • ClamAV: Xls.Downloader.Emotet-bd646319c2d29cd6-9951195-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-bd646319c2d29cd6-9951195-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
4282a66cb39a54151a7150b41c26dfb71d035cb8ac904f3e031d21c44da4ada6		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 3523 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.