Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 d9fd1922b63d559e…

MALICIOUS

Office (OOXML) / .XLSX

209.8 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300
MD5: 8537d148046ca220dc0444765c07ab6b SHA-1: 6517fc506420e2d31a53a2e79e973ed8b9e0da3d SHA-256: d9fd1922b63d559ed8a5d9b5554ba6e8b627b237b1e9b4aa2c67eca6634f2648
180 Risk Score

Malware Insights

Emotet · confidence 85%

MITRE ATT&CK
T1204.002 User Execution: Malicious File T1059.005 Command and Scripting Interpreter: Visual Basic for Applications T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell

The sample is an OOXML Excel file containing multiple hidden Excel 4.0 macro sheets (XLM), which is a highly suspicious structural anomaly. A ClamAV detection specifically identifies this as Xls.Downloader.Emotet, and the use of multiple XLM sheets to obfuscate the downloader logic is a known characteristic of the Emotet family. The extracted scripts are heavily obfuscated binary data, making the exact command line or URL impossible to reconstruct from the static excerpts provided, but the overall pattern is consistent with a downloader.

Heuristics 3

  • Excel 4.0 macro sheet (10 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
a600c06266bbd0dd2b61dfcd96dbddd020e5f170c3c38b6dcb6601e0a598335b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 322 bytes
xlm_sheet_01.bin
68be8c00857b18185ff0efb8ce0fc7dee973358028087aac0391f0de04fd7463		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2194 bytes
xlm_sheet_02.bin
831006bd0c553b0a91e53049f365208dac45a8febf71d9228e851897dfadc0a7		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 477 bytes
xlm_sheet_03.bin
c21656b2108164807026268f3c90e971984d43f78f4ad8d0629615e7c816fd1b		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.bin 428 bytes
xlm_sheet_04.bin
4c84712dfb6cbb1c894d2e20e88ae297988dcebbb5983e8d204a6eb35559433d		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.bin 428 bytes
xlm_sheet_05.bin
e98ba1032156b96d449962420d43c5579d2546bcffa300550b5879a220ba52cf		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet5.bin 428 bytes
xlm_sheet_06.bin
9d333dba9a33ad9b51bb0f6d0a215f0d5b3a70c36bd3f94c58bf82af3f604595		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet6.bin 428 bytes
xlm_sheet_07.bin
897e1d866cde58047a18fa0a80b9cfd322c031317c3ed7767f4a8fa4facff84c		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet7.bin 428 bytes
xlm_sheet_08.bin
27d5fabe81e784fe70f5c731c1f56cde57615c49df63f803f4d10f289dc491e8		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet8.bin 428 bytes
xlm_sheet_09.bin
afdc61e17960ec6f9ed7ed69d731a47414b0ad9e84008649fb89ebf19cc5bca0		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet9.bin 348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.