Emotet Office (OOXML) / .XLSM malware analysis — malicious · f880f2bac7afb16c

MALICIOUS

Office (OOXML) / .XLSM

2.70 MB Created: 2021-05-06 15:12:59 UTC Authoring application: Microsoft Excel 15.0300

MD5: 434625b2e7404e04cb8915cd6da06be6 SHA-1: 9d3ce4e5e4c08cf01f09d66b0ec1b9014fdceb24 SHA-256: f880f2bac7afb16cb872c175caa984f6d5118ea39b0514983d9ac1e4176deac5

308 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The presence of a Workbook_Open macro and CreateObject calls strongly indicates malicious VBA code execution. The script leverages MSXML2.XMLHTTP and ADODB.Stream to download a payload from one of the provided URLs, likely establishing a second-stage infection. The ClamAV detection of 'Doc.Downloader.Emotet-10019767-0' further confirms the Emotet family and its downloader capabilities.

Heuristics 9

ClamAV: Doc.Downloader.Emotet-10019767-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-10019767-0
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffickerdigital.guru/wp-content/plugins/stops-core-theme-and-plugin-updates/templates/notices/3RKTmgwCIosO1Q.php
- https://touchuphouse.com/wp-content/plugins/wp-file-manager/inc/images/VsMQ4PexH.php
- https://kpleads.com/kpleads.ali/wp/wp-includes/js/codemirror/njNvuZ7MIDRL.php
- https://bhuttangill.com/wp-includes/js/tinymce/themes/inlite/Agk5yxu6D3SEW.php
- https://lepassionatta.com/components/com_sppagebuilder/views/media/tmpl/wjAVlObnVdiUu.php
- https://wickerconsultingllc.com/wp-content/plugins/force-regenerate-thumbnails/jquery-ui/redmond/MGggfHzY0QH0Cp3.php
- https://senalgrafsac.com/prueba/vendor/bootstrap/css/Z1Oeq1XQhEC.php
- https://artncraft.online/wp-content/plugins/elementor/data/base/ITmEihJkT.php
- https://kineas.be/wp-content/plugins/wordpress-seo/inc/exceptions/5QvWk6qm.php

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5fcbcd55f0623228ebec1c9d0eb4aa594b9c40075cafc5cb173b704b60157703`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	1996953 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `f64aed3c8210ea33efe5b4ec150c5341c1ba9781c0985331c591ad1fcb123736`	vba-project	OOXML VBA project: xl/vbaProject.bin	4037632 bytes
Detection ClamAV: Doc.Downloader.Emotet-10019767-0 Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.