Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 1fdbe1188ec28873…

MALICIOUS

Office (OOXML) / .XLSX

21.4 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: df8473c262018f71663fe8fcbfb58d3c SHA-1: 9afdf56fd9892f27b57c02c13e15f7e3312dd35d SHA-256: 1fdbe1188ec28873c160197539dd9a3acafc4953e9c23c66ca00fed15c6d19ef
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment

The file is identified by ClamAV as a known dropper, indicating its primary function is to deliver other malware. While no specific document body or scripts were extracted, the heuristic detection strongly suggests a malicious intent to download and execute a payload. The file's nature as an Excel document points towards a phishing or social engineering attack vector.

Heuristics 1

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0