Emotet — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 ec8c539504f5e384…

MALICIOUS

Office (OLE) / .XLS

142.5 KB Created: 2015-06-05 18:19:34 Authoring application: Microsoft Excel First seen: 2022-03-24
MD5: b44730c7f679709f222637dd08d1dbad SHA-1: 4ceaaf0d411f34b045ca7c254b1730affcee9602 SHA-256: ec8c539504f5e384e654bf6f5c796ac560b6b61ba42302bf287e0c65c41a83a5
200 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample contains Excel 4.0 macros, specifically an Auto_Open macro that utilizes the RUN function, indicating it's designed to execute external code. ClamAV detection confirms this as Emotet. The macros appear to construct a path to 'svs32.exe' and also contain multiple URLs that are likely used to download the next stage of the payload. The presence of the RUN function and the URLs strongly suggests a downloader functionality.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • ClamAV: Xls.Downloader.Emotet-adc2d23d2dc26dd0-9950240-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Emotet-adc2d23d2dc26dd0-9950240-0
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
eee0a3dec225fd0088c74c7ab34b064dd06b0d4f7198f4d9a113e7b902ce722a		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6706 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.