Emotet Office (OOXML) / .XLSX malware analysis — malicious · 99fedcd03a496046

MALICIOUS

Office (OOXML) / .XLSX

2.86 MB Created: 2021-05-07 10:35:50 UTC Authoring application: Microsoft Excel 15.0300

MD5: d99b2a9c2c03c9b7947b3943c1f730ce SHA-1: 1f0aa55d8b1c05b91fa1d91b090cf42577056138 SHA-256: 99fedcd03a496046f7c1fd1312be6c47a4292c6c8fa3b41c6c0cc66fb40d32aa

308 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a Workbook_Open VBA macro that utilizes CreateObject and Environ calls to execute a command via rundll32.exe. This macro is designed to download and execute a second-stage payload from one of the numerous embedded URLs. ClamAV detections strongly indicate the Emotet family, known for its downloader capabilities.

Heuristics 9

ClamAV: Doc.Downloader.Emotet-10019767-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10019767-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://tuahpandan.com.my/beta/wp-includes/js/tinymce/langs/Rm23mrdsybMeXG.php
- https://arfresa.com/globospayasoperu.com/web/wp-content/et-cache/178/088bWm9bjVQJe.php
- https://adventphilomels.org/wp-includes/sodium_compat/src/Core32/ChaCha20/ecbCQtOlK8wLZzY.php
- https://grupoakrabu.com/img/galeria/JUzw6w6kn0.php
- https://rccgpromisedland.org/admin-assets/fonts/fontawesome/svgs/brands/e4E1oOjZXWEj.php
- https://kineas.be/wp-content/plugins/wordpress-seo/inc/exceptions/7cAm96kjg5T9i.php
- https://gulfbeautygt.com/images/byaLcZQlkP5.php
- https://ultradiademexico.com/templates/ja_purity/styles/header/blue/nDNeZQP5.php
- https://tafaghodi.ir/resume/files/OKBWIjkslY8bOV.php
- https://wypozyczalnia-dragon.pl/libraries/fof/integration/joomla/filesystem/v566mU4QOL0.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5b31c4914e98b92801e58b1f1121e1549e09d7f6939f7ba6cf4a9ee1765bc5eb`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1991146 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `14b1cd16012335e4cae5bb85e4617da095647e3fce04b9942152bb83746f0156`	vba-project	OOXML VBA project: xl/vbaProject.bin	4056064 bytes
Detection ClamAV: Doc.Downloader.Emotet-10019767-0 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.