CHQ020114862.xls

Classification: Malicious

CHQ020114862.xls is a malicious file sample. Linked to Ta505 activity. Reported by 1 threat source, last seen 2020-07-03. Detected by 27 antivirus engines.

Detection summary

  • 27 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: TA505 (G0092)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
TA505 Abuse.ch 2020-07-03 10:12:51 2020-07-03 10:12:51 G0092 TA505

Sample information

Filenames
CHQ020114862.xls
File type
application/vnd.ms-excel
MD5
bb921af7b9c502c207b6f40fa9937cb7
SHA-1
c205c932952bfa8acfee0f4fb8aee0d0d27608e1
SHA-256
02ec074f0269a8c818c9c7909b0a199ef6eda4e345e2b1517d09244fe4ab7dd9
First indexed
2020-07-03 11:15:03
Last updated
2026-03-26 11:19:12

Antivirus detections

EngineDetection
ClamAVWin.Dropper.Hideproc-6663113-0
FireEyeVB:Trojan.Valyria.3290
McAfeeX97M/Dropper.ad
ArcabitVB:Trojan.Valyria.DCDA
BitDefenderThetaGen:NN.ZedlaF.34130.tu4@aujb2Ki
SymantecISB.Exploit!gen9
ESET-NOD32a variant of VBA/TrojanDropper.Agent.BHV
CynetMalicious (score: 85)
KasperskyHEUR:Trojan.MSOffice.SAgent.gen
BitDefenderVB:Trojan.Valyria.3290
MicroWorld-eScanVB:Trojan.Valyria.3290
RisingDropper.StealthLoader/VBA!1.C75D (CLASSIC:dGZlOgbmVzPg3k21qQ)
Ad-AwareVB:Trojan.Valyria.3290
F-SecureHeuristic.HEUR/Macro.Downloader.MRUZ.Gen
EmsisoftVB:Trojan.Valyria.3290 (B)
AviraHEUR/Macro.Downloader.MRUZ.Gen
FortinetW32/Dropper.GIF!tr
Antiy-AVLTrojan[Exploit]/OLE.CVE-2014-6352
Endgamemalicious (high confidence)
ZoneAlarmHEUR:Trojan.MSOffice.SAgent.gen
TACHYONSuspicious/W97.NS.Gen
AhnLab-V3Dropper/XLS.TA505.S1242
ALYacVB:Trojan.Valyria.3290
MAXmalware (ai score=80)
VBA32BScope.Trojan.Wacatac
SentinelOneDFI - Malicious OLE
GDataVB:Trojan.Valyria.3290