mt.zip
- SHA256 824f1241b004a7d3fa8b3cd0b3ae378a4fbb51722259cc8f59610d4146ba4f09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
data/AquesTalkDa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
data/AquesTalkDa.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
data/f1/AquesTalkDa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
data/f1/AquesTalkDa.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
}EXŃQ[.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
}EXŃQ[.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target mt.zip
- Size 147KB
- Sample260727-qhpypsbb45
- SHA256 824f1241b004a7d3fa8b3cd0b3ae378a4fbb51722259cc8f59610d4146ba4f09
- MD5 07132b1cc7a2439ac9c7675dfe722351
- SHA1 0019f1cbf04210377df946d1f061f7830b69e233
- SHA512 0a6589a76d372fe8fd2b8e4a59733bcf018abe4cbf6a06e6ab2b591e4a48242fc4606977ece10ab652eef150088e73c24f206e12b301ddefd82027dd7549a333
- SSDEEP 3072:tB87d5BhEyw0jdjwSK+AN2Q2wzCwYSBhEyw0jdjwSK+AN2Q2wzCwYul:LK5P5FLKqQ2yfP5FLKqQ2yfl
- TLSH T160E312A642B5043C82C337BEEF6F5A3E7DF9D8E42151AA05D05DA99EC8B077383095E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/data/AquesTalkDa.dll unpack001/data/f1/AquesTalkDa.dll unpack001/}EXŃQ[.exe
File Explorer
-
mt.zip.zip 147KB
-
data/AqLicense.txt2KB
-
data/AquesTalkDa.dll.dll 108KB
-
data/f1/AqLicense.txt2KB
-
data/f1/AquesTalkDa.dll.dll 108KB
-
setting.ini154B
-
.txt1KB
-
}EXŃQ[.exe.exe 44KB
data/AqLicense.txt
- SHA256 21a31c02fc0a57b340de91792301f2e168abc7368d335686f9d05333e10ad298
- MD5 eadf599be95f6afa75fa50b2295521c0
- SHA1 a0d34e8631bba73794a9ccf3f05d184459939315
- SHA512 631ac15459838caacf11304277a929817c02471b3ea76e1b0e61e8d4c329c8a89f7c4f963bc96a82481c9b91282da67742a6875b76d23f2cb661556ab2be8f23
- TLSH T1685124F8947E9D11D62F829DD26BE24B5096F79200EEE3CD7F1732E02E63D69229000C
- MD5 SHA1 SHA512 TLSH
data/AquesTalkDa.dll
- IMPHASH 00031788930db67494b5cda1b8513e03
- SHA256 b881265823d26141379c3957182a987c9542c0648a1a8f7f5a9c6d38651db967
- MD5 376b1e9518442c94c0735600316ec1ca
- SHA1 f2c54da49d596d9522e503a3a65f0a7e29bdecc3
- SHA512 26c2d2882f6b480738246245c7d8ff74b4b384aca4e7182d7def3f889fed08469ce597c18ac4f5c9aaf4b441c4be6a3bf527f5727b63b156839f921816233a9d
- SSDEEP 3072:zm/LIq/TZd5CDSC0sG0AyvdXKMqNRo47PdUn+h/Y:iznYDKsG2zOo47PdU6/Y
- TLSH T1CBB3D0219B538470C95D07789956F73877394DC5C386C3938328FE3ABA312BAED1A687
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
waveOutPrepareHeader
waveOutWrite
waveOutOpen
waveOutReset
waveOutClose
PlaySoundA
user32
PostMessageA
msvcrt
strncmp
_adjust_fdiv
_initterm
strchr
__CxxFrameHandler
free
malloc
??2@YAPAXI@Z
_stricmp
??3@YAXPAX@Z
strncpy
strtok
kernel32
DisableThreadLibraryCalls
AquesTalkDa_Create
AquesTalkDa_IsPlay
AquesTalkDa_Play
AquesTalkDa_PlaySync
AquesTalkDa_Release
AquesTalkDa_Stop
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=22, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=20, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
data/f1/AqLicense.txt
- SHA256 21a31c02fc0a57b340de91792301f2e168abc7368d335686f9d05333e10ad298
- MD5 eadf599be95f6afa75fa50b2295521c0
- SHA1 a0d34e8631bba73794a9ccf3f05d184459939315
- SHA512 631ac15459838caacf11304277a929817c02471b3ea76e1b0e61e8d4c329c8a89f7c4f963bc96a82481c9b91282da67742a6875b76d23f2cb661556ab2be8f23
- TLSH T1685124F8947E9D11D62F829DD26BE24B5096F79200EEE3CD7F1732E02E63D69229000C
- MD5 SHA1 SHA512 TLSH
data/f1/AquesTalkDa.dll
- IMPHASH 00031788930db67494b5cda1b8513e03
- SHA256 b881265823d26141379c3957182a987c9542c0648a1a8f7f5a9c6d38651db967
- MD5 376b1e9518442c94c0735600316ec1ca
- SHA1 f2c54da49d596d9522e503a3a65f0a7e29bdecc3
- SHA512 26c2d2882f6b480738246245c7d8ff74b4b384aca4e7182d7def3f889fed08469ce597c18ac4f5c9aaf4b441c4be6a3bf527f5727b63b156839f921816233a9d
- SSDEEP 3072:zm/LIq/TZd5CDSC0sG0AyvdXKMqNRo47PdUn+h/Y:iznYDKsG2zOo47PdU6/Y
- TLSH T1CBB3D0219B538470C95D07789956F73877394DC5C386C3938328FE3ABA312BAED1A687
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
waveOutPrepareHeader
waveOutWrite
waveOutOpen
waveOutReset
waveOutClose
PlaySoundA
user32
PostMessageA
msvcrt
strncmp
_adjust_fdiv
_initterm
strchr
__CxxFrameHandler
free
malloc
??2@YAPAXI@Z
_stricmp
??3@YAXPAX@Z
strncpy
strtok
kernel32
DisableThreadLibraryCalls
AquesTalkDa_Create
AquesTalkDa_IsPlay
AquesTalkDa_Play
AquesTalkDa_PlaySync
AquesTalkDa_Release
AquesTalkDa_Stop
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=22, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=20, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
setting.ini
- SHA256 bbfe52211d19ddfa16c18c739e83683f5f25a0dd474dc4faa959bcd74c43f3ca
- MD5 a89653399b0cef924bac1631dfef70b9
- SHA1 67250cf1857949a906fd2c36fdafd8576efffacc
- SHA512 91d59f8905620497b0697c0b6b31c55ebee854052183a248394d04ee18bd664637a3793ece443f1e31b73b4f0fb3fb08b68ff91374a79104e7a6e88c3a5d5674
- TLSH T1DCC08CD00B35112FD0713428E0331718AC8802B00B5F2D29B83E6ECA0CCD0102228A97
- MD5 SHA1 SHA512 TLSH
.txt
- SHA256 fdce530f30671bd1cefb6e63846419158b83c9b06cb97d6dd7349644f27dab01
- MD5 d87a768eb34ffc299919e51d2f0eb370
- SHA1 a2722f8fc1816955538f638d729524e54860e5b7
- SHA512 cb2d14dc43b14256b8496be53235e8311588779761e4b3d7e4086fd46e53963f0e3b8c557b639c63bd2c246fef0d958cedeb1eab8179ceb52a0c4971f8a6aa2b
- TLSH T1F441A630DD9FFB30941AD627CABB6D6AC6B493A1129E28C1705B53DD04D5E8332AF11E
- MD5 SHA1 SHA512 TLSH
}EXŃQ[.exe
- IMPHASH 26896e3e823ffc34c1016f8075b2592e
- SHA256 a0178015bb07da49610a1c6113c0898d23c8cf57ad44fcadab0615c85ce9e89f
- MD5 e72443c664516bd07fab29e6f7b5b27d
- SHA1 774ad74e3a3183e2f3a8e7560878b3d082d99b99
- SHA512 f000c08c4b67def6bd4ccc7a98a8ec547877b4e5ace771abe737d014748b1a3b59e407a54c3bc80a49d66b8f6ec576f9202e889e31ab409404625258669465e8
- SSDEEP 768:I34++PKf8F9rdsDXJYYBimDyxNgfcl0Y:IOe8FzsrLiEkND0Y
- TLSH T167139823B54C1521F24947F208B786B57F13BC756962AF1F224BBA5D1D30A02AFA631F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaR8FixI4
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaCyMul
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaVarCmpNe
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
__vbaStrLike
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaBoolVar
__vbaStrFixstr
ord520
__vbaRefVarAry
__vbaFpR8
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
ord709
ord631
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaGet3
__vbaGet4
__vbaPutOwner3
__vbaVarTstEq
__vbaVarLikeVar
__vbaPrintObj
ord561
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaR8Cy
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord607
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaGetOwner3
__vbaGetOwner4
ord537
ord644
ord645
_CIlog
__vbaFileOpen
__vbaNew2
ord648
__vbaInStr
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaFpCy
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord614
__vbaVarCopy
ord616
__vbaVarLateMemCallLd
__vbaFpI4
__vbaRecDestructAnsi
ord617
_CIatan
ord618
__vbaStrMove
ord619
__vbaI4Cy
ord650
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
_CIexp
__vbaRecAssign
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=6, id=9, version=8041,
count=1, id=13, version=8169,