Malicious Office (OOXML) / .XLSX — malware analysis report

Static analysis result for SHA-256 958e7b15ef090a3e…

MALICIOUS

Office (OOXML) / .XLSX

23.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: aac32364f4b2be8d2c4cdd958ce06854 SHA-1: 8395297a684353a4023d3899be2c6f933c7d0afd SHA-256: 958e7b15ef090a3efff8b2e87e249fba193c9b465df14f5e872bbd31c656108a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment

The file is identified by ClamAV as a known dropper, indicating its purpose is to deliver other malware. While no specific document body or scripts were extracted, the detection signature suggests it is designed to execute malicious code, likely through macro execution or an embedded exploit.

Heuristics 1

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0