Qbot — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 63790f11728510ba…

MALICIOUS

Office (OOXML) / .XLSX

1.39 MB First seen: 2022-05-09
MD5: 66e079c3a6f33f3838b287d2e8c527f1 SHA-1: f8b395ed8bdbeb8a658be0e2082c9664eb16264d SHA-256: 63790f11728510ba60e1c151c3502f53c9628ced58e58ecafe6ce38d6acb5627
188 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains Excel 4.0 macros that utilize WinAPI functions like URLDownloadToFileA to download a payload to C:\ProgramData\Dis.ooocxx, C:\ProgramData\Disa.ooocxx, or C:\ProgramData\Disb.ooocxx. Subsequently, it attempts to execute the downloaded file using regsvr32. The ClamAV detection explicitly identifies this as Qbot.

Heuristics 4

  • Excel 4.0 macro sheet (1 sheet(s)) critical OOXML_XLM_MACROSHEET
    Malformed OOXML local headers contain an Excel 4.0 (XLM) macro sheet. XLM was a major Office malware vector during 2020-2022 and is rarely used in modern legitimate workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • Binary XLM macro sheet with WinAPI/download strings critical OOXML_XLM_BINARY_WINAPI_STRINGS
    Excel 4.0 macro sheet is stored as BIFF12/XLSB binary data and contains Win32 download or process-execution API strings.
  • ClamAV: Xls.Downloader.Qbot-aa2a2a3fd5f4342a-9950245-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Qbot-aa2a2a3fd5f4342a-9950245-0
  • Malformed OOXML package with recoverable local headers low OOXML_MALFORMED_ZIP_LOCAL_HEADERS
    The OOXML ZIP central directory is invalid or missing, but local file headers expose a recoverable Office package. This can create parser divergence between tolerant Office/ZIP readers and scanners that rely only on the central directory.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_05.bin
9a1cd25eed4eda135238a1482f8e0100471e4e84fc0622b689b2004e42852a68		 xlm-macrosheet Malformed OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.