Qbot — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 874e7d31d491acaa…

MALICIOUS

Office (OOXML) / .XLSX

21.4 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: c7cdd10d21546d96700dadaba6d37c8e SHA-1: 410f0ff276cecee89bd88db6b8d7544f972335fe SHA-256: 874e7d31d491acaaf11eb670bad91e4ba4faf3747c6537d7eb7274c18cc41582
60 Risk Score

Malware Insights

Qbot · confidence 90%

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment

The file is identified by ClamAV as 'Xls.Dropper.QbotDocu12020-9818439-0', strongly suggesting it is a Qbot dropper. Qbot is known to be distributed via malicious Office documents, often using social engineering to trick users into enabling macros. The primary function of such documents is to download and execute the Qbot malware.

Heuristics 1

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0

Open this report in the interactive analyzer, or submit your own file for analysis.