Qbot — Office (OOXML) malware analysis

Static analysis result for SHA-256 104a18fa2517766e…

MALICIOUS

Office (OOXML)

21.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2020-12-28
MD5: 5b75c9248c98c7c1611da68b1fe6a51c SHA-1: 99624857d61aa527058452b625a8c92d3c109a40 SHA-256: 104a18fa2517766ec5593b1f2c3cefae3e22247b94d77f62e0c74da7f4773799
282 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically using the dangerous functions CALL, EXEC, and HALT. The macros are designed to download a payload from the URL http://kavok.ind.br/ds/2312.gif using rundll32. This is consistent with Qbot's known behavior of using macro-enabled documents to download and execute further stages.

Heuristics 6

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0
  • Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: CALL, EXEC, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kavok.ind.br/ds/2312.gif In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 22665 bytes
SHA-256: 7e76422d8d7f3e68c804bffa0a5f3e6e737f3dc780b564943f347d53caf662fb
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A1:AA40"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.44140625" defaultRowHeight="14.4" x14ac:dyDescent="0.3"/><cols><col min="1" max="26" width="4.44140625" style="2"/><col min="27" max="27" width="4.44140625" style="2" customWidth="1"/><col min="28" max="16384" width="4.44140625" style="2"/></cols><sheetData><row r="1" spans="1:27" x14ac:dyDescent="0.3"><c r="A1" s="1"/><c r="B1" s="1"/><c r="C1" s="1"/><c r="D1" s="1"/><c r="E1" s="1"/><c r="F1" s="1"/><c r="G1" s="1"/><c r="H1" s="1"/><c r="I1" s="1"/><c r="J1" s="1"/><c r="K1" s="1"/><c r="L1" s="1"/><c r="M1" s="1"/><c r="N1" s="1"/><c r="O1" s="1"/><c r="P1" s="1"/><c r="Q1" s="1"/><c r="R1" s="1"/><c r="S1" s="1"/><c r="T1" s="1"/><c r="U1" s="1"/><c r="V1" s="1"/><c r="W1" s="1"/><c r="X1" s="1"/><c r="Y1" s="1"/><c r="Z1" s="1"/><c r="AA1" s="1"/></row><row r="2" spans="1:27" x14ac:dyDescent="0.3"><c r="A2" s="1"/><c r="B2" s="1"/><c r="C2" s="1"/><c r="D2" s="1"/><c r="E2" s="1"/><c r="F2" s="1"/><c r="G2" s="1"/><c r="H2" s="1"/><c r="I2" s="1"/><c r="J2" s="1"/><c r="K2" s="1"/><c r="L2" s="1"/><c r="M2" s="1"/><c r="N2" s="1"/><c r="O2" s="1"/><c r="P2" s="1"/><c r="Q2" s="1"/><c r="R2" s="1"/><c r="S2" s="1"/><c r="T2" s="1"/><c r="U2" s="1"/><c r="V2" s="1"/><c r="W2" s="1"/><c r="X2" s="1"/><c r="Y2" s="1"/><c r="Z2" s="1"/><c r="AA2" s="1"/></row><row r="3" spans="1:27" x14ac:dyDescent="0.3"><c r="A3" s="1"/><c r="B3" s="1"/><c r="C3" s="1"/><c r="D3" s="1"/><c r="E3" s="1"/><c r="F3" s="1"/><c r="G3" s="1"/><c r="H3" s="1"/><c r="I3" s="1"/><c r="J3" s="1"/><c r="K3" s="1"/><c r="L3" s="1"/><c r="M3" s="1"/><c r="N3" s="1"/><c r="O3" s="1"/><c r="P3" s="1"/><c r="Q3" s="1"/><c r="R3" s="1"/><c r="S3" s="1"/><c r="T3" s="1"/><c r="U3" s="1"/><c r="V3" s="1"/><c r="W3" s="1"/><c r="X3" s="1"/><c r="Y3" s="1"/><c r="Z3" s="1"/><c r="AA3" s="1"/></row><row r="4" spans="1:27" x14ac:dyDescent="0.3"><c r="A4" s="1"/><c r="B4" s="1"/><c r="C4" s="1"/><c r="D4" s="1"/><c r="E4" s="1"/><c r="F4" s="1"/><c r="G4" s="1"/><c r="H4" s="1"/><c r="I4" s="1"/><c r="J4" s="1"/><c r="K4" s="1"/><c r="L4" s="1"/><c r="M4" s="1"/><c r="N4" s="1"/><c r="O4" s="1"/><c r="P4" s="1"/><c r="Q4" s="1"/><c r="R4" s="1"/><c r="S4" s="1"/><c r="T4" s="1"/><c r="U4" s="1"/><c r="V4" s="1"/><c r="W4" s="1"/><c r="X4" s="1"/><c r="Y4" s="1"/><c r="Z4" s="1"/><c r="AA4" s="1"/></row><row r="5" spans="1:27" x14ac:dyDescent="0.3"><c r="A5" s="1"/><c r="B5" s="1"/><c r="C5" s="1"/><c r="D5" s="1"/><c r="E5" s="1"/><c r="F5" s="1"/><c r="G5" s="1"/><c r="H5" s="1"/><c r="I5" s="1"/><c r="J5" s="1"/><c r="K5" s="1"/><c r="L5" s="1"/><c r="M5" s="1"/><c r="N5" s="1"/><c r="O5" s="1"/><c r="P5" s="1"/><c r="Q5" s="1"/><c r="R5" s="1"/><c r="S5" s="1"/><c r="T5" s="1"/><c r="U5" s="1"/><c r="V5" s="1"/><c r="W5" s="1"/><c r="X5" s="1"/><c r="Y5" s="1"/><c r="Z5" s="1"/><c r="AA5" s="1"/></row><row r="6" spans="1:27" x14ac:dyDescent="0.3"><c r="A6" s="1"/><c r="B6" s="1"/><c r="C6" s="1"/><c r="D6" s="1"/><c r="E6" s="1"/><c r="F6" s="1"/><c r="G6" s="1"/><c r="H6" s="1"/><c r="I6" s="1"/><c r="J6" s="1"/><c r="K6" s="1"/><c r="L6" s="1"/><c r="M6" s="1"/><c r="N6" s="1"/><c r="O6" s="1"/><c r="P6" s="1"/><c r="Q6" s="1"/><c r="R6" s="1"/><c r="S6" s="1"/><c r="T6" s="1"/><c r="U6" s="1"/><c r="V6" s="1"/><c r="W6" s="1"/><c r="X6" s="1"/><c r="Y6" s="1"/><c r="Z6" s="1"/><c r="AA6" s="1"/></row><row r="7" spans="1:27" x14ac:dyDescent="0.3"><c r="A7" s="1"/><c r="B7" s="1"/><c r="C7" s="1"/><c r="D7" s="1"/><c r="E7" s="1"/><c r="F7" s="1"/><c r="G7" s="1"/><
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.