Resubmissions

21/05/2026, 14:26

260521-rr2vasft4q6

21/05/2026, 14:22

260521-rp1jfshy9z3

General

  • Target
    Message.eml
  • Size 366KB
  • Sample260521-rr2vasft4q
  • SHA256 f5d6d54a23b8b2d2cafe3a72a8db330032993b9d70b024d5dc9443b41c8ca1ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 366KB
  • Ekaya Housing Association_17008.xlsx
    .xlsx 171KB
  • Outlook-3mes3xob.png
    .png 24KB
  • Outlook-3xm4aei4.png
    .png 30KB
  • Outlook-invest-in-.png
    .png 22KB
  • email-html-2.txt
    .html 6KB
  • email-plain-1.txt
    1KB

Message.eml

  • SHA256 f5d6d54a23b8b2d2cafe3a72a8db330032993b9d70b024d5dc9443b41c8ca1ef
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 21 May 2026 12:31:33 +0000

Subject

120526 - Ekaya Housing Association - NDA

Content-Type

multipart/mixed; boundary="_008_VI1PR02MB42221E750F914F698EBDC5A280012VI1PR02MB4222eurp_"

Received

from CWLP265CA0502.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:18b::16) by GVXPR07MB10088.eurprd07.prod.outlook.com (2603:10a6:150:123::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Thu, 21 May 2026 12:32:04 +0000

from AMS0EPF0000019C.eurprd05.prod.outlook.com (2603:10a6:400:18b:cafe::f7) by CWLP265CA0502.outlook.office365.com (2603:10a6:400:18b::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Thu, 21 May 2026 12:32:04 +0000

from AM0PR83CU005.outbound.protection.outlook.com (2a01:111:f403:c201::1) by AMS0EPF0000019C.mail.protection.outlook.com (2603:10a6:20f:fff4:0:15:0:8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Thu, 21 May 2026 12:32:04 +0000

from VI1PR02MB4222.eurprd02.prod.outlook.com (2603:10a6:803:7e::31) by DBBPR02MB10554.eurprd02.prod.outlook.com (2603:10a6:10:532::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.14; Thu, 21 May 2026 12:31:34 +0000

from VI1PR02MB4222.eurprd02.prod.outlook.com ([fe80::f737:9591:f845:96e3]) by VI1PR02MB4222.eurprd02.prod.outlook.com ([fe80::f737:9591:f845:96e3%5]) with mapi id 15.21.0048.013; Thu, 21 May 2026 12:31:34 +0000

Received-Spf

Pass (protection.outlook.com: domain of ekaya.co.uk designates 2a01:111:f403:c201::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::1; helo=AM0PR83CU005.outbound.protection.outlook.com; pr=C

Message-Id

<VI1PR02MB42221E750F914F698EBDC5A280012@VI1PR02MB4222.eurprd02.prod.outlook.com>

Extracted URLs

  • file http://www.ekaya.co.uk/

  • file http://www.ekaya.co.uk/wp-content/uploads/2018/05/Ekaya-Privacy-Policy-1.pdf