Qbot — Office (OLE) / .XLS malware analysis

Static analysis result for SHA-256 e729cd74fbe0b2db…

MALICIOUS

Office (OLE) / .XLS

537.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-10-02
MD5: e804c9b70c9358a57463169e043fe85c SHA-1: 0c9afb5db0efc918dd675d295d5772f20e1f3078 SHA-256: e729cd74fbe0b2dba58a9bbd9eb973ff806a9f37b5d93266b3d2e86e46b86d8e
220 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1218.010 System Binary Proxy Execution: Regsvr32

The XLS file contains VBA macros, including Auto_Open and Auto_Close functions, which are commonly used for malicious execution. The critical heuristic 'OLE_VBA_SPLIT_KEYWORD_OBFUSCATION' indicates that the dangerous API 'regsvr32' was reassembled from split string literals. The script further reconstructs the command line arguments for regsvr32, suggesting it is used to download and execute a second-stage payload from a remote location.

Heuristics 5

  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • ClamAV: Xls.Downloader.Qbot-b760f03263b7c21b-9950248-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.Qbot-b760f03263b7c21b-9950248-0
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
658441cd825df9b7ed7ef6d0867985a34733bc19b34bf42def3906ad3b19244e		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3709 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.