Emotet — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 df42d0949fba72e0…

MALICIOUS

Office (OOXML) / .XLSX

262.1 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-03-01
MD5: 2584e189ec7c8d03a2e13615585e16c6 SHA-1: 03cb96a77c1895fd575fdb4bf7e3198c5059ad6e SHA-256: df42d0949fba72e0bacb12ea2bcbc1d4a94da6b7d68f4001fe79c1c02a64908a
180 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as malicious by ClamAV with the signature Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0, indicating it's an Emotet downloader. Static analysis reveals the presence of Excel 4.0 macro sheets within the XLSX file, which are commonly used for malicious purposes. These macros are likely responsible for downloading and executing a secondary payload.

Heuristics 3

  • Excel 4.0 macro sheet (3 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLSB international XLM macro sheet hidden in .xlsx critical OOXML_XLSB_INTL_MACROSHEET_IN_XLSX
    OOXML package is named .xlsx but contains XLSB workbook parts and an international Excel 4.0 macro sheet. This hides XLM macro execution from scanners that trust the extension or only inspect XML worksheet parts. The technique is macro execution, not a document-parser CVE.
  • ClamAV: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-OOXML_XL-af43432fbcb8603c-9980048-0

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
9e8ff10d9dc7b91a707bd9db9ef8f1f85215faa95a475bdb829acc6aa2435df9		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 2376 bytes
xlm_sheet_01.bin
048a1a0d53332ec585623aa2624a3c193f53c199cdef7f811aaa6935dad05f08		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 428 bytes
xlm_sheet_02.bin
a56a4b9f5554fb691823d2d03ab5576333fdded05e59fe68aca1010f539ddf53		 xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.