Qbot Office (OOXML) / .XLSX malware analysis — malicious · 1497becf69b499e8

MALICIOUS

Office (OOXML) / .XLSX

1.13 MB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-05-25

MD5: b6dfa6a9f73d21ffca32d2a68c84f67a SHA-1: b07f359fddc1c786a33d59f7d568b0efad81a6af SHA-256: 1497becf69b499e8d4ed229775d5f70f1ab8cffb3ddd4f526c09f8b6cf3c8a46

120 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is identified as malicious by ClamAV and contains Excel 4.0 macro sheets. These macros appear to construct URLs and filenames, such as 'C:\Users\Public\Documents\Qbot\payload.exe', and likely execute 'regsvr32.exe' to download and run a second-stage payload. The presence of Qbot-related indicators in the ClamAV signature further supports this assessment.

Heuristics 2

Excel 4.0 macro sheet (4 sheet(s)) critical OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
ClamAV: Xls.Downloader.Qbot-b760f03262b6e23b-9950440-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Downloader.Qbot-b760f03262b6e23b-9950440-0

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.bin` `a537b74caa9aff2d58a5c283562e9193cbcee1ec1598a20149d3292fc4d5c8ec`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.bin	2286 bytes
`xlm_sheet_01.bin` `ea5fcee142a9af13fb8eeb8f9fc87ad7791a0f0faa22efda136eabd54cf1631f`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet2.bin	1906 bytes
`xlm_sheet_02.bin` `0961a82d4316cbd6c555ae6dfc0dbbc481b52f45cbb53ea43fe3a0dc752cd34b`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet3.bin	337 bytes
`xlm_sheet_03.bin` `f906ee3df91cbc1fd7e0b20c2278d8825b4db29c6770cef788049f6d22f94413`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet4.bin	1002 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.