Qbot — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 8827f753e479eba9…

MALICIOUS

Office (OOXML) / .XLSX

262.3 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2022-03-17
MD5: be6231746613e0b90a65fac14e349b99 SHA-1: 6b62ef75a9e48bc4c8c18fa78c03f26565d5ce93 SHA-256: 8827f753e479eba9624719b5284bd5513eb7f92f68666f3247c0e0fbf88e873d
180 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is identified as malicious by ClamAV and exhibits critical heuristic firings for Excel 4.0 macros and reassembled XLM payloads. The embedded XLM macro sheet contains functions like 'URLDownloadTo' and 'Create', strongly suggesting the intent to download and execute a second-stage payload, consistent with Qbot downloader behavior. The presence of 'uRlMon' as a reassembled payload name further supports this.

Heuristics 3

  • Excel 4.0 macro sheet (12 sheet(s)) critical OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks. The macro sheet is stored as XLSB/BIFF12 binary content, which many XML-only OOXML scanners miss.
  • XLM payload reassembled from CHAR()/split formulas critical OOXML_XLM_REASSEMBLED_PAYLOAD
    An Excel 4.0 macro sheet builds its payload inside the formula token stream by concatenating per-character CHAR() calls and string fragments, so no WinAPI name, shell command, or URL is ever contiguous in the .bin for a literal-bytes scan to find. Reassembling the formulas recovered download/execute API names, LOLBin commands (regsvr32/rundll32/mshta/wmic/powershell), or a payload URL — the de-obfuscated download-and-run kill chain.
  • ClamAV: Xls.Downloader.Qbot03221-9942499-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Qbot03221-9942499-0

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.bin
9649d9ad4c39f240db9abbf6b64da8e6abcc65e137ead106264913da49beef5b
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.bin 1308 bytes
xlm_sheet_01.bin
687fdf76d29f0c6431ab5692dfed6286b8d8737722a30bb60032b8ee9eaedde2
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.bin 2723 bytes
xlm_sheet_02.bin
8ff76b252ceeba1f05df1248bd8803bdb4add7b14449876f11efd1faba3e0bce
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.bin 1289 bytes
xlm_sheet_03.bin
c00c83141fd8cd5545aacde5198b88eda848b709924e3b46fe90b5e1e4f2a5bc
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.bin 773 bytes
xlm_sheet_04.bin
551885fcbd386ecf55907f97c9fef3b2aef7468b3700ad1b82e2928a7cc0abe3
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.bin 672 bytes
xlm_sheet_05.bin
64cefe187b9bc3f58b3831e06892a6f20a972a991bb8e56878bd75017788f902
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.bin 562 bytes
xlm_sheet_06.bin
d85c821431c9f022e62357cf58036f46139eaddd46235d3576ec1dd3ea6cf33f
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.bin 442 bytes
xlm_sheet_07.bin
1e17ca5892c49a5cea3471253f1819054f7474285cee062faf67e975692f44ad
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet2.bin 714 bytes
xlm_sheet_08.bin
b5fa3c6dcbced786fc63ea82b656a070157c6756dda9bed3682c78cad26d0ec5
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.bin 393 bytes
xlm_sheet_09.bin
864c5104912084b3c739f8a7d5f8e693b57f0cb1ad06d9668564b0ad84102180
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet3.bin 634 bytes
xlm_sheet_10.bin
05634df2d86c1eafc6eb9f167c644a623f2755f69c080a109004182ceaff5db5
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet4.bin 634 bytes
xlm_sheet_11.bin
056c1e6dde570e2c179c5874e851ad32e4435a6998f118e41add2ab263b28f62
xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.bin 393 bytes