MALICIOUS
190
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic for Applications
T1204.002 User Execution: Malicious File
T1105 Ingress Tool Transfer
T1027 Obfuscation
T1140 T1059.005
The sample is an XLSM file containing multiple Excel 4.0 macro sheets and an Auto_Open trigger. A ClamAV detection specifically identifies this as Emotet. The extracted document body contains obfuscated strings that, when reconstructed, reveal the intent to download and execute payloads from 'https://kickupbrasil.com.br/nt90DaCy/lik.html', 'http://dunyadeniz.com.tr/waQu5tG0t/lik.html', and 'https://licidiomas.com.br/ZoR3sJicB/lik. Gradle a second-stage payload to local paths such as 'C:\Datop\besta.ocx', 'C:\Datop\bestb.ocx', and 'C:\Datop\bestc.ocx'.
Heuristics 5
-
Excel 4.0 macro sheet (7 sheet(s)) critical OOXML_XLM_MACROSHEETSpreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
-
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAMEWorkbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
-
ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0
-
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEETExcel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/spreadsheetml/2006/main
- http://schemas.microsoft.com/office/excel/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/relationships
- http://schemas.openxmlformats.org/markup-compatibility/2006
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
- http://schemas.microsoft.com/office/spreadsheetml/2014/revision
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6
Extracted artifacts 7
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_sheet_00.xmlbfdb681f21981b78c9a60c00d0057f29adcbac924cd2dc5d15fb7bf42a6170bc |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml | 3811 bytes |
xlm_sheet_01.xml81afbec68b440a54106b6def5cd4caad91892db55618e64b0899f4e9d30b94d6 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet1.xml | 1364 bytes |
xlm_sheet_02.xml266d7010f68a8209ce7e417fbc7d9ff5ff1cac2023fa0eda206b4a2d838adc05 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet2.xml | 1368 bytes |
xlm_sheet_03.xml4dc31a0105bb40c9f9066fe748bb798f5af26e177ab2b78e171ae71f4c26a620 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet3.xml | 1368 bytes |
xlm_sheet_04.xml13325edd607c51d14ea8fc3be43ac49f9d5f3f977ef94af1d52d12296d0db47c |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet4.xml | 1365 bytes |
xlm_sheet_05.xmlb2de7b630f6e18e05ccbd356628c80682a583ec48f42f6a0eb629ba7a553c7ce |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet5.xml | 1370 bytes |
xlm_sheet_06.xml7845dbb5a56eac6068ea8a9d675ed83a90f6ea1d85bbe620d85d3a842b443999 |
xlm-macrosheet | OOXML XLM macro sheet: xl/macrosheets/sheet6.xml | 1367 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.