Emotet Office (OOXML) / .XLSX malware analysis — malicious · fc27d37592a4bed5

MALICIOUS

Office (OOXML) / .XLSX

115.1 KB Created: 2015-06-05 18:17:20 UTC Authoring application: Microsoft Excel 12.0000

MD5: fe935a66e69251b78128be2d57183884 SHA-1: 33912f69beb2e98a0d826bfe9dcca6c871d856e8 SHA-256: fc27d37592a4bed5c0da2782f7bc4f744a6e7a3fbf61d6408830389a9402d399

200 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

This XLSX file contains a Workbook_Open macro, a common technique for Emotet. The macro utilizes Wscript.Shell to create and execute batch and VBScript files. The critical ClamAV detection and the presence of VBA macros strongly indicate malicious intent. The script attempts to download a payload from a reconstructed URL: "http://sumedahonline.com/wp-content/HyzNXJ30XQEVcBSRH/cdfg=http://divachintexiles.com/wp-incudades/WWHWRKs8KvNzNFm6/,http://hotelanlamaabalo.com/1520/bUdhpEPdf/,http://shwenantawwin.com/copma/XTnZJii02vfg".

Heuristics 5

ClamAV: Xls.Downloader.EmotetExcel02223-9938902-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.EmotetExcel02223-9938902-0
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA project inside OOXML medium OOXML_VBA

Document contains vbaProject.bin — VBA macros present

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `df1eb14c222394595c0518b49eec2b55ed9573146c5f1717dedceddd2e199a2b`	vba-macro	oletools.olevba.extract_macros (decoded VBA source from OOXML)	12041 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`vbaProject_00.bin` `d34fa6d03c2c33c366f1068fd25a62cb30df87e6047a05e3d345e644389fc77d`	vba-project	OOXML VBA project: xl/vbaProject.bin	42496 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.