Emotet — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 c528e4e79822ef50…

MALICIOUS

Office (OLE) / .XLS

94.5 KB Created: 2015-06-05 18:19:34 Authoring application: Microsoft Excel First seen: 2022-07-05
MD5: 6b21809ddf73cf5f57952cd19948e0de SHA-1: b8ead6ce4f4e2090a7b39103d4777c09f11eea6f SHA-256: c528e4e79822ef50b865a92de20a1aad0cf7c1dec7b6662a07efb6665a3996cf
200 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Service Execution: Service Execution T1566.001 Phishing: Spearphishing Attachment

The sample is an Excel 4.0 macro-enabled spreadsheet containing an Auto_Open macro, which is a known technique for executing malicious code upon opening. ClamAV detection explicitly identifies it as an Emotet downloader. The macro uses dangerous formula APIs, indicating it's designed to perform malicious actions, likely downloading and executing a secondary payload.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • ClamAV: Xls.Downloader.Emotet-ea81817e7f807ab1-9952142-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-ea81817e7f807ab1-9952142-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
9291cd9b67994511c2d262982058400183febce67749ee89bf9c3370878c4cf0		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 8110 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.