Emotet Office (OOXML) / .XLSM malware analysis — malicious · 8b1097f7341684fa

MALICIOUS

Office (OOXML) / .XLSM

207.2 KB Created: 2006-09-28 05:33:49 UTC Authoring application: Microsoft Excel 12.0000

MD5: a1ced00f04bcc53831a012db91599318 SHA-1: c52b4b780c915638e87a9eca9b12769432a57a71 SHA-256: 8b1097f7341684fa7f89c185bbd8b26f4b201144bda74ade0f728d5b30c48c98

120 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The file is an XLSM document containing VBA macros, as indicated by the OOXML_VBA heuristic and the presence of macros.bin. The ClamAV detection explicitly names this as an Emotet variant. The VBA code utilizes CreateObject to execute a batch file that downloads and runs an executable from 'http://myworldipdtpv.com/1.exe' and saves it as 'c:\programdata\sihos.exe'. The script also attempts to execute this downloaded payload.

Heuristics 3

ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `16339ff1f95ee7368841dd5c33bc15b6406c47587d05f62c5d7d7a5b866d34eb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	3946 bytes
`vbaProject_00.bin` `47b47af9959eb127e480e25b36a22e7a24b4a4d45f6a7d28c60d6b039e8d1c37`	vba-project	OOXML VBA project: xl/vbaProject.bin	27136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.