Qbot Office (OOXML) / .XLSX malware analysis — malicious · 81cf31de931b3fea

MALICIOUS

Office (OOXML) / .XLSX

23.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300

MD5: 05e147ba99b75630afe0599a69a75adc SHA-1: 686afaacfe49f50aa16482a8c1593436813faf82 SHA-256: 81cf31de931b3fea2e09a73de4270b296fc3fbf5b15d43013c6ba207c17a1487

60 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment

The file is identified by ClamAV as 'Xls.Dropper.QbotDocu12020-9818439-0', strongly indicating it functions as a dropper for the Qbot malware family. Its primary purpose is to deliver and execute a malicious payload, likely through macro execution within the Excel document. The detection signature itself serves as a key indicator of its malicious nature and intended function.

Heuristics 1

ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0

Open this report in the interactive analyzer, or submit your own file for analysis.