NOTE: This spoiler was submitted by Jeremy
We begin with the text that reminds us that this film is based on a true story.
There is an old woman in a house hearing whispers coming from a wooden box. She appears to be trying to open it but cannot. She goes to fetch a hammer to try and break it as someone rings the doorbell. The box causes her to age faster and almost decompose, and then, the spirit of the box thrashes the old woman until it slams her face down on a table.
Clyde Brenek (Jeffrey Dean Morgan) is a basketball coach for a university, putting his team through some plays and drills. We see him go visit his daughters and ex-wife Stephanie (Kyra Sedgwick). The older daughter, Hannah (Madison Davenport), doesn't pay Clyde much attention. The younger daughter, Em (Natasha Calis), draws some posters to get her school to use little to no meat in the cafeteria. She shows them to Clyde, and he likes the one that says "Stop the killing."
Clyde prepares to take the girls to his place for the weekend. The girls, particularly Hannah, already seem to be closer to Stephanie's new dentist beau, Brett, and as a result of their parents' divorce, she is distant and cold toward her father. Before they leave, Stephanie reminds Clyde not to let the kids eat pizza or anything unhealthy.
They get to a home that Clyde says will be their new home. The girls aren't too pleased, but he makes it up to them with none other than pizza. However, the dinner becomes tense when Em suggests that her parents will get back together, and Hannah upsets her by insisting that it'll never happen. At night, Clyde and Em make shadow puppets and bond.
The next day, he takes his daughters to a yard sale because Hannah reminds him that he needs plates. Em finds some fancy gloves and a hat, but then comes across the mysterious box with Hebrew inscriptions. She asks Clyde to buy it, which he does, along with the hat and boxes of dishes. She sees a woman glaring at her as she holds the box, and she goes into the house. The woman tends to the woman from the beginning of the film, who is bandaged up, and sees Em with the box, and begins screaming in fear. When they get home, Em can't open the box, so she asks for Clyde's help, but he can't do it either, deducing that whoever made it didn't want it to be opened.
At night, voices whisper to Em, waking her up. She opens the box easily and finds a few items like a ring. The next day, Hannah tries to show off a dance routine she practices with her team. Em sits quietly and somberly while holding the ring, which Hannah thinks is because of the whole situation with their parents.
Weird things begin to happen. Hannah screams when she finds an oversized moth in her room. She tells her father to get rid of it, but Clyde squashes it on her bed. Em is upset over her dad killing a living creature, and Hannah hates that he squashed it on her bed. Later on, Em keeps hitting the plate with her fork as she grabs each piece of her pancakes, and when Clyde tells her to stop, she stabs him with the fork, but is immediately repentant, though he is angry.
Clyde takes the girls back to Stephanie's, where Hannah spills the beans on the pizza. Stephanie is obviously not happy. She also confronts him about Clyde not telling her or the girls that he got a job offer at a university in North Carolina. Later, Clyde stays overtime at work and misses a dance performance from Hannah, and she is pissed at him.
Sometime later, the girls see a mess in the kitchen along with a noise that frightens them. The intruder flees through the doggy door, and Clyde assures the girls it was a raccoon. Finally, Em unleashes a whole swarm of the oversized moths in the house, which frighten Hannah, and they surround Em in her room. Stephanie sarcastically thinks this had to do with the pizza Clyde bought the girls.
Em starts getting more violent as her dependency on the box increases. She brings it to school, and a classmate of hers grabs it out of curiosity. She immediately notices it's missing, and then tries grabbing it from the kid, smacking him hard across the face and screaming for it until the teacher pulls her off. She is sent to the principal where Clyde and Stephanie are called to. The principal and teacher tell them to keep her away from the box. However, that night, the voice whispers to Ms. Shandy, the teacher. She tries to open it, but the spirit begins terrorizing her. Blood comes from her eyes, and she is violently thrashes around the room until she is thrown out the window.
Clyde takes Em to a diner where she continues eating faster than usual. She knows the teacher died, and then tells Clyde that she has a female friend from the box that only speaks to her, and that she is "hungry." She asks Clyde to pick the box up from the classroom for her. He does, but then disposes of it in a dumpster.
That night, Em is suffering without her box, and demands that Clyde retrieve it, but he doesn't. She leaves the room and angrily tells Clyde she hates him, and an invisible force strikes Em across the face twice, leading her and Hannah to think Clyde hit her. Em runs away with Clyde chasing her until she reaches the dumpster and retrieves the box. She opens the box again, and the demon orders something for her in Hebrew, but Em refuses to do what it tells her to do, and another swarm of moths flies out and into her mouth. Clyde finds her unconscious and brings her back to Stephanie and Hannah, who are waiting with the cops.
Em is at the hospital, and Stephanie is furious with Clyde for supposedly hitting their daughter. She tells him to just leave for North Carolina.
Clyde takes the box to a Jewish professor at his university. The man tells Clyde that the box possibly contains an ancient Jewish demon called a Dybbuk. The box was meant to conceal the demon when it could not be controlled. Later, Clyde travels to the Hasidic community and meets with a rabbi named Tzadok (Matisyahu). He takes Clyde to see other rabbis who become afraid when they see the box and ultimately helpless when Clyde reveals that the demon is controlling his daughter. Clyde is informed that the Dybbuk looks for an innocent host to achieve life. The only way to defeat the demon is to send it back into the box by uttering it's name, which nobody knows.
At Stephanie's home, Em is more violent without the box. She almost attacks Brett in the garage, and then pushes a bunch of glass at Stephanie's bare feet at night, after she catches her eating raw meat. She breaks down in her mother's arms. Later on, the invisible force attacks Brett and causes his teeth to fall out (literally a form of painful irony). She is taken back to the hospital. An x-ray is done on her, and Stephanie and Hannah are horrified to see a ghoulish face appear in Em's body.
Clyde and Stephanie reunite after coming to terms with the fact that Em is possessed. They, along with Hannah and Tzadok, take Em to a private area in the hospital to perform the exorcism. Tzadok breaks the glass in the box to learn the Dybbuk's name, which is Abizo. They place a few items from the heart in the box (Hannah puts a lock of her hair, Stephanie puts a family picture, and Clyde puts a necklace). Em violently thrashes as Tzadok tries to get the Dybbuk out. She escapes the room, and Clyde chases her. He corners her in a room where she attacks him, screaming at Abizo to take him and release Em. When the other three find them, Em is released, but Clyde is possessed. Tzadok screams Abizo's name repeatedly until it crawls out of Clyde and shows it's true form (think of Gollum after what happened to him at the end of Return of the King). It cries out as it goes back into the box once and for all. The family embraces each other.
Things are going back to normal. Em and Hannah sleep peacefully together while it is implied that Clyde will stay and remain friends with Stephanie. He calls Tzadok to thank him for his help. He tells Clyde he will take the box to his father and find a safe place to bury it. However, after they hang up, a truck collides with Tzadok's car, totaling it and most likely killing him. The box, of course, remains intact as Abizo whispers final words to the audience.