Emotet Office (OOXML) / .XLSX malware analysis — malicious · c0ca93c99c716038

MALICIOUS

Office (OOXML) / .XLSX

209.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300

MD5: 82fbb720496a027500d6a9f05085cd18 SHA-1: b6313d82b92e24f22c82f75b3731d3dceed128a8 SHA-256: c0ca93c99c716038efb4b12d414a09c44de4b11860fbcbdcaac4f68e4a032509

180 Risk Score

Malware Insights

Emotet · confidence 85%

MITRE ATT&CK

T1204.002 User Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic for Applications T1105 Ingress Tool Transfer

The sample is an XLSX file containing multiple hidden Excel 4.0 macro sheets (XLM), which is a highly suspicious structural anomaly. ClamAV specifically identifies the sample as Emotet, and the use of multiple XLM sheets to deliver a payload is a characteristic pattern of this family. The extracted scripts are heavily obfuscated or binary-encoded, preventing the exact reconstruction of C2 URLs or commands, but the structural evidence and heuristic firings strongly support the downloader functionality.

Heuristics 3

Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX

OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 10

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `a600c06266bbd0dd2b61dfcd96dbddd020e5f170c3c38b6dcb6601e0a598335b`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	322 bytes
`xlm_sheet_01.bin` `68be8c00857b18185ff0efb8ce0fc7dee973358028087aac0391f0de04fd7463`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin	2194 bytes
`xlm_sheet_02.bin` `831006bd0c553b0a91e53049f365208dac45a8febf71d9228e851897dfadc0a7`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.bin	477 bytes
`xlm_sheet_03.bin` `c21656b2108164807026268f3c90e971984d43f78f4ad8d0629615e7c816fd1b`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.bin	428 bytes
`xlm_sheet_04.bin` `4c84712dfb6cbb1c894d2e20e88ae297988dcebbb5983e8d204a6eb35559433d`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet4.bin	428 bytes
`xlm_sheet_05.bin` `e98ba1032156b96d449962420d43c5579d2546bcffa300550b5879a220ba52cf`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet5.bin	428 bytes
`xlm_sheet_06.bin` `9d333dba9a33ad9b51bb0f6d0a215f0d5b3a70c36bd3f94c58bf82af3f604595`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet6.bin	428 bytes
`xlm_sheet_07.bin` `897e1d866cde58047a18fa0a80b9cfd322c031317c3ed7767f4a8fa4facff84c`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet7.bin	428 bytes
`xlm_sheet_08.bin` `27d5fabe81e784fe70f5c731c1f56cde57615c49df63f803f4d10f289dc491e8`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet8.bin	428 bytes
`xlm_sheet_09.bin` `afdc61e17960ec6f9ed7ed69d731a47414b0ad9e84008649fb89ebf19cc5bca0`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet9.bin	348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.