Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 6e850d9044a03b40…

MALICIOUS

Office (OOXML) / .XLSX

209.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 11ac9d909d43f7fbc3459c5a0be969ce SHA-1: c86a24704bab6757ffbb062c479e0c89e25ebd73 SHA-256: 6e850d9044a03b40cc06b56f9ab884ddaa8519cfbb13fdb58f4acf6e56dddb82
120 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0, indicating it belongs to the Emotet family. Static analysis revealed the presence of multiple Excel 4.0 macro sheets, a common technique for Emotet. These macros are likely responsible for downloading and executing a secondary payload, consistent with Emotet's typical behavior.

Heuristics 2

  • Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
a600c06266bbd0dd2b61dfcd96dbddd020e5f170c3c38b6dcb6601e0a598335b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 322 bytes
xlm_sheet_01.bin
68be8c00857b18185ff0efb8ce0fc7dee973358028087aac0391f0de04fd7463		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2194 bytes
xlm_sheet_02.bin
831006bd0c553b0a91e53049f365208dac45a8febf71d9228e851897dfadc0a7		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 477 bytes
xlm_sheet_03.bin
c21656b2108164807026268f3c90e971984d43f78f4ad8d0629615e7c816fd1b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.bin 428 bytes
xlm_sheet_04.bin
4c84712dfb6cbb1c894d2e20e88ae297988dcebbb5983e8d204a6eb35559433d		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.bin 428 bytes
xlm_sheet_05.bin
e98ba1032156b96d449962420d43c5579d2546bcffa300550b5879a220ba52cf		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet5.bin 428 bytes
xlm_sheet_06.bin
9d333dba9a33ad9b51bb0f6d0a215f0d5b3a70c36bd3f94c58bf82af3f604595		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet6.bin 428 bytes
xlm_sheet_07.bin
897e1d866cde58047a18fa0a80b9cfd322c031317c3ed7767f4a8fa4facff84c		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet7.bin 428 bytes
xlm_sheet_08.bin
27d5fabe81e784fe70f5c731c1f56cde57615c49df63f803f4d10f289dc491e8		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet8.bin 428 bytes
xlm_sheet_09.bin
afdc61e17960ec6f9ed7ed69d731a47414b0ad9e84008649fb89ebf19cc5bca0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet9.bin 348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.