Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 77fd3c900b665308…

MALICIOUS

Office (OOXML) / .XLSX

259.2 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-02-21
MD5: a49904175e29050c02f27bcbf4062f6e SHA-1: c6e78c4d511322fb49a73daebbe711c03ce27384 SHA-256: 77fd3c900b6653087507d7dbf92c9f2b2392a822375fd2148202b79e589082f9
120 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV with the signature Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0, indicating it is an Emotet downloader. Static analysis revealed the presence of Excel 4.0 macros within multiple macro sheets, which are commonly used to initiate malicious execution chains. These macros likely download and execute a secondary payload, consistent with Emotet's typical behavior.

Heuristics 2

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
81dcc9c9db0425ac93b78fc84226ddea2175d405c8e99d7854af5e4b865a25ab		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2504 bytes
xlm_sheet_01.bin
c9cbb4ffb18cafdb32b829cb3b7bb4c8391cbf70ff163c9a93663c07506ddd28		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 484 bytes
xlm_sheet_02.bin
5cc32e55e48524841b3308343924fad64749bc7070436462ba749571a21012a8		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.