General

  • Target
    hb7hEXB_TelVnRlx8yW6UAhKeLMPrXP0_2026-10-02T08_10_07.779Z.eml
  • Size 30.8MB
  • Sample261002-j2r4vaybph
  • SHA256 9d23aabb512f88ef02f2f5f37f305033354729b77ab4ab73e03ec5e4737b80ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • hb7hEXB_TelVnRlx8yW6UAhKeLMPrXP0_2026-10-02T08_10_07.779Z.eml
    .eml 30.8MB
  • Description of analog automatic station announcement.doc
    .doc 1.5MB
  • Station announcement simulation software.zip
    .zip 20.9MB
  • Station announcement simulation software/Airport_Makkah_new3.1.gpx
    .xml 31KB
  • Station announcement simulation software/D3Dcompiler_47.dll
    .dll 3.5MB
  • Station announcement simulation software/Description of analog automatic station announcement.doc
    .doc 1.5MB
  • Station announcement simulation software/Qt5Core.dll
    .dll 5.2MB
  • Station announcement simulation software/Qt5Gui.dll
    .dll 5.1MB
  • Station announcement simulation software/Qt5Network.dll
    .dll 1.7MB
  • Station announcement simulation software/Qt5Svg.dll
    .dll 341KB
  • Station announcement simulation software/Qt5Widgets.dll
    .dll 6.1MB
  • Station announcement simulation software/Qt5Xml.dll
    .dll 211KB
  • Station announcement simulation software/ROUTEMANAGER.exe
    .exe 1.2MB
  • Station announcement simulation software/bearer/qgenericbearer.dll
    .dll 88KB
  • Station announcement simulation software/bearer/qnativewifibearer.dll
    .dll 80KB
  • Station announcement simulation software/config/Madrid_BARCA.gpx
    .xml 2KB
  • Station announcement simulation software/config/RailwayNodes.xml
    .xml 2KB
  • Station announcement simulation software/config/Text_info.xml
    .xml 771B
  • Station announcement simulation software/config/route.xml
    .xml 1KB
  • Station announcement simulation software/file/Madinah_Airport.gpx
    .xml 17KB
  • Station announcement simulation software/file/Makkah_Madinah.gpx
    .xml 20KB
  • Station announcement simulation software/file/RailwayNodes.xml
    .xml 1.7MB
  • Station announcement simulation software/file/Text_info.xml
    .xml 2KB
  • Station announcement simulation software/file/route.xml
    .xml 4KB
  • Station announcement simulation software/file/route1.xml
    .xml 9KB
  • Station announcement simulation software/file/special_gps.xml
    .xml 239B
  • Station announcement simulation software/iconengines/qsvgicon.dll
    .dll 42KB
  • Station announcement simulation software/imageformats/qgif.dll
    .dll 33KB
  • Station announcement simulation software/imageformats/qicns.dll
    .dll 45KB
  • Station announcement simulation software/imageformats/qico.dll
    .dll 35KB
  • Station announcement simulation software/imageformats/qjpeg.dll
    .dll 241KB
  • Station announcement simulation software/imageformats/qsvg.dll
    .dll 26KB
  • Station announcement simulation software/imageformats/qtga.dll
    .dll 28KB
  • Station announcement simulation software/imageformats/qtiff.dll
    .dll 438KB
  • Station announcement simulation software/imageformats/qwbmp.dll
    .dll 27KB
  • Station announcement simulation software/imageformats/qwebp.dll
    .dll 421KB
  • Station announcement simulation software/libEGL.dll
    .dll 21KB
  • Station announcement simulation software/libGLESV2.dll
    .dll 2.7MB
  • Station announcement simulation software/libgcc_s_dw2-1.dll
    .dll 117KB
  • Station announcement simulation software/libstdc++-6.dll
    .dll 1.5MB
  • Station announcement simulation software/libwinpthread-1.dll
    .dll 77KB
  • Station announcement simulation software/opengl32sw.dll
    .dll 15.3MB
  • Station announcement simulation software/platforms/qwindows.dll
    .dll 1.7MB
  • Station announcement simulation software/translations/qt_ca.qm
    170KB
  • Station announcement simulation software/translations/qt_cs.qm
    154KB
  • Station announcement simulation software/translations/qt_de.qm
    168KB
  • Station announcement simulation software/translations/qt_en.qm
    23B
  • Station announcement simulation software/translations/qt_fi.qm
    156KB
  • Station announcement simulation software/translations/qt_fr.qm
    162KB
  • Station announcement simulation software/translations/qt_he.qm
    135KB
  • Station announcement simulation software/translations/qt_hu.qm
    88KB
  • Station announcement simulation software/translations/qt_it.qm
    157KB
  • Station announcement simulation software/translations/qt_ja.qm
    126KB
  • Station announcement simulation software/translations/qt_ko.qm
    121KB
  • Station announcement simulation software/translations/qt_lv.qm
    149KB
  • Station announcement simulation software/translations/qt_pl.qm
    144KB
  • Station announcement simulation software/translations/qt_ru.qm
    154KB
  • Station announcement simulation software/translations/qt_sk.qm
    122KB
  • Station announcement simulation software/translations/qt_uk.qm
    154KB
  • Station announcement simulation software/vcuANDdbs.exe
    .exe 228KB
  • email-html-2.txt
    .html 19KB
  • email-plain-1.txt
    2KB

hb7hEXB_TelVnRlx8yW6UAhKeLMPrXP0_2026-10-02T08_10_07.779Z.eml

  • SHA256 9d23aabb512f88ef02f2f5f37f305033354729b77ab4ab73e03ec5e4737b80ad
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 29 Sep 2026 16:41:16 +0800

Subject

Re: [F070] Issues to ckeck.

Content-Type

multipart/mixed; boundary="----=_001_NextPart073455611300_=----"

Received

from FRZP193MB2584.EURP193.PROD.OUTLOOK.COM (::1) by AM0P193MB3169.EURP193.PROD.OUTLOOK.COM with HTTPS; Tue, 29 Sep 2026 08:51:47 +0000

from AM9P192CA0013.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:21d::18) by FRZP193MB2584.EURP193.PROD.OUTLOOK.COM (2603:10a6:d10:13e::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 08:47:13 +0000

from DB3PEPF0000885D.eurprd02.prod.outlook.com (2603:10a6:20b:21d:cafe::39) by AM9P192CA0013.outlook.office365.com (2603:10a6:20b:21d::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.24 via Frontend Transport; Tue, 29 Sep 2026 08:47:13 +0000

from mx07-0057ba01.pphosted.com (185.132.183.137) by DB3PEPF0000885D.mail.protection.outlook.com (10.167.242.8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 08:47:12 +0000

from pps.filterd (m0214374.ppops.net [127.0.0.1]) by mx07-0057ba01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68T7Snx62207058 for <[email protected]>; Tue, 29 Sep 2026 10:47:11 +0200

from out203-205-221-173.mail.qq.com (out203-205-221-173.mail.qq.com [203.205.221.173]) by mx07-0057ba01.pphosted.com (PPS) with ESMTPS id 4gx8s8jhk2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 29 Sep 2026 10:42:00 +0200 (MEST)

from LAPTOP-87JKHB66 ([152.175.36.102]) by newxmesmtplogicsvrszb51-1.qq.com (NewEsmtp) with SMTP id A4F0D049; Tue, 29 Sep 2026 16:41:15 +0800

Received-Spf

Pass (protection.outlook.com: domain of foxmail.com designates 203.205.221.173 as permitted sender) receiver=protection.outlook.com; client-ip=203.205.221.173; helo=out203-205-221-173.mail.qq.com; pr=C

X-Mailer

Foxmail 7.2.25.563[cn]

Message-Id

<[email protected]>

Extracted URLs

  • file https://tlg-alm.atlassian.net/browse/SRIF070-54

  • file https://tlg-alm.atlassian.net/browse/SRIF070-57

  • file https://tlg-alm.atlassian.net/browse/SRIF070-64

  • file https://tlg-alm.atlassian.net/browse/SRIF070-65

  • file https://tlg-alm.atlassian.net/browse/SRIF070-66

  • file https://twitter.com/TalgoGroup

  • file https://www.facebook.com/TalgoGroup

  • file https://www.instagram.com/talgogroup/

  • file https://www.linkedin.com/company/talgogroup/

  • Show all