QuarantineMessage (19).zip
- SHA256 b538aa5d25b4aab26fb353b3993fa798018739ae5d594357bec974688b267fe6
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
attachment-1.html
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral2
Sample
attachment-1.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
General
- Target QuarantineMessage (19).zip
- Size 19KB
- Sample260522-rcdtxsds2j
- SHA256 b538aa5d25b4aab26fb353b3993fa798018739ae5d594357bec974688b267fe6
- MD5 099a57fc598aabff1a229166e1806716
- SHA1 e1742807c4dcd2a616990666dea56213820f0390
- SHA512 8f498e20eafe5a2da6ce5695328e056ca9fada7c5f61ce2bd74b3fcf073031fff36192afe06a990c43ca0c01a72281cb070c9f710d596f740d2cfe2468e8e2bc
- SSDEEP 384:npXc/iFhw3l26SMftKQnZgIRPqMwVddT0IeFD3vZq/T7oZ2EMgPDAS4Am2I:neOhw3lfSMB6IRPq7XqZq/wZ29gPDAS4
- TLSH T1B392E1A53F039124D1BDF9B957C5B906035A9CA2B5BD11C18A38F6735AE12740B247CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
QuarantineMessage (19).zip.zip 19KB
-
02ff422e-fd3e-4413-4e11-08deb797321a/55cf1fd1-8274-95a9-50c9-c0b9a27c0609.eml.eml 55KB
-
attachment-2.eml 40KB
-
attachment-1.html .js 2KB
-
email-plain-1.txt167B
02ff422e-fd3e-4413-4e11-08deb797321a/55cf1fd1-8274-95a9-50c9-c0b9a27c0609.eml
- SHA256 b875a121e9e895339eabf9c3bf26cd38d662a9de3e39a5f14d1fef62571c40e2
- MD5 83092cbe5f14524bd1a4caf8dfec2c7b
- SHA1 8881bf625cac239ec218c985fe9b53b021adfdb9
- SHA512 b59940ddcbc40368a31a8afa7914620112b7fa294608071005cca06d2089f4bcc2ae23082dfdfabc17f7760c49d103ab76c4aefa181816db17a62cad4a2697aa
- SSDEEP 1536:PiMUyriz0Y2iSUyss0c6Gq0XVogeUBraG:PiMUCiSUJUdH
- TLSH T1BC433B568FEA6571D94722D90D00BE0B62A72DEEA2777080392931650E4FADC8F0F75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
intuit-invoicing®Draft_NDA.Review|Alert-service.Automail|payments?campaign_label=automatic_billing&utm_source=billing&utm_campaign=billing_payment_success&utm_medium=email&email_sent=1777632925&euid=A3_da8ZlXJuINNEG4n2qRKkXaqzg&eaid=37075122222&x_eaid=084add0ccf&[email protected]
Return-Path
=?iso-8859-1?Q?intuit-invoicing=AEDraft=5FNDA.Review|Alert-service.Automa?= =?iso-8859-1?Q?il|payments=3Fcampaign=5Flabel=3Dautomatic=5Fbilling&utm?= =?iso-8859-1?Q?=5Fsource=3Dbilling&utm=5Fcampaign=3Dbilling=5Fpayment=5Fs?= =?iso-8859-1?Q?uccess&utm=5Fmedium=3Demail&email=5Fsent=3D1777632925&euid?= =?iso-8859-1?Q?=3DA3=5Fda8ZlXJuINNEG4n2qRKkXaqzg&eaid=3D37075122222&x=5Fe?= =?iso-8859-1?Q?aid=3D084add0ccf&[email protected]?=
Date
Fri, 22 May 2026 00:15:06 +0000
Subject
[EXTERNAL] #Received_Submission_eDocxs_review 5/22/2026_Ref#4973846485a464b87ae724259d5097266b0f70b5914d13e96e
Content-Type
multipart/mixed; boundary="_7e655759-e6cb-4bdc-a554-a2d3d50ec63a_"
Received
from SJ2PR10MB6964.namprd10.prod.outlook.com (2603:10b6:a03:4cb::11) by DS7PR10MB5278.namprd10.prod.outlook.com with HTTPS; Fri, 22 May 2026 00:15:19 +0000
from SJ0PR03CA0361.namprd03.prod.outlook.com (2603:10b6:a03:3a1::6) by SJ2PR10MB6964.namprd10.prod.outlook.com (2603:10b6:a03:4cb::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.16; Fri, 22 May 2026 00:15:14 +0000
from SJ1PEPF00001CDE.namprd05.prod.outlook.com (2603:10b6:a03:3a1:cafe::88) by SJ0PR03CA0361.outlook.office365.com (2603:10b6:a03:3a1::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Fri, 22 May 2026 00:15:14 +0000
from AM0PR83CU005.outbound.protection.outlook.com (2a01:111:f403:c201::1) by SJ1PEPF00001CDE.mail.protection.outlook.com (2603:10b6:a0f:fc02::106) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Fri, 22 May 2026 00:15:13 +0000
from CWLP265CA0417.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:1b6::7) by DB9PR04MB9626.eurprd04.prod.outlook.com (2603:10a6:10:309::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May 2026 00:15:09 +0000
from AMS1EPF0000003F.eurprd04.prod.outlook.com (2603:10a6:400:1b6:cafe::48) by CWLP265CA0417.outlook.office365.com (2603:10a6:400:1b6::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Fri, 22 May 2026 00:15:09 +0000
from [127.0.0.1] (185.121.176.168) by AMS1EPF0000003F.mail.protection.outlook.com (10.167.16.36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Fri, 22 May 2026 00:15:08 +0000
Received-Spf
Pass (protection.outlook.com: domain of hoeflershop.at designates 2a01:111:f403:c201::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::1; helo=AM0PR83CU005.outbound.protection.outlook.com; pr=C
SoftFail (protection.outlook.com: domain of transitioning hoeflershop.at discourages use of 185.121.176.168 as permitted sender)
Message-Id
attachment-2
- SHA256 73ba347172b792ed16a691887c4fb1151e5d740672bd02ad7bc8f9c927930f2a
- MD5 9505bd98d2ac9744d9e619a1c5179c50
- SHA1 d338d7a03bc1f8fe7924fdbc061ebe99f48e67b4
- SHA512 26a6dcff64423846737b215b98c2e3126fc53345e853095f406d375708ab125a918420f8abdb69a3dab93efdc502513c4dd11c3352fde68c1a15d9f4d989c57e
- SSDEEP 768:LiX0k+U1n0Ve7UAoUGf1os9uc6Gq0XVoN6tIrzU3HEt4nrW1DxSf:LiSUyss0c6Gq0XVogeUBraQ
- TLSH T18C1308468EEA5672D94632DA0D00BE0B65BB1DEEA17370803D3930660D4FAED4F4A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
intuit-invoicing®Draft_NDA.Review|Alert-service.Automail|payments?campaign_label=automatic_billing&utm_source=billing&utm_campaign=billing_payment_success&utm_medium=email&email_sent=1777632925&euid=A3_da8ZlXJuINNEG4n2qRKkXaqzg&eaid=37075122222&x_eaid=084add0ccf&[email protected]
Return-Path
=?iso-8859-1?Q?intuit-invoicing=AEDraft=5FNDA.Review|Alert-service.Automa?= =?iso-8859-1?Q?il|payments=3Fcampaign=5Flabel=3Dautomatic=5Fbilling&utm?= =?iso-8859-1?Q?=5Fsource=3Dbilling&utm=5Fcampaign=3Dbilling=5Fpayment=5Fs?= =?iso-8859-1?Q?uccess&utm=5Fmedium=3Demail&email=5Fsent=3D1777632925&euid?= =?iso-8859-1?Q?=3DA3=5Fda8ZlXJuINNEG4n2qRKkXaqzg&eaid=3D37075122222&x=5Fe?= =?iso-8859-1?Q?aid=3D084add0ccf&[email protected]?=
Date
Fri, 22 May 2026 00:15:06 +0000
Subject
[EXTERNAL] #Received_Submission_eDocxs_review 5/22/2026_Ref#4973846485a464b87ae724259d5097266b0f70b5914d13e96e
Content-Type
text; name=Confidential_Molley_Ref#4973846485a464b87ae724259d5097266b0f70b5914d13e96e.html
Received
from SJ0PR03CA0361.namprd03.prod.outlook.com (2603:10b6:a03:3a1::6) by SJ2PR10MB6964.namprd10.prod.outlook.com (2603:10b6:a03:4cb::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.16; Fri, 22 May 2026 00:15:14 +0000
from SJ1PEPF00001CDE.namprd05.prod.outlook.com (2603:10b6:a03:3a1:cafe::88) by SJ0PR03CA0361.outlook.office365.com (2603:10b6:a03:3a1::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Fri, 22 May 2026 00:15:14 +0000
from AM0PR83CU005.outbound.protection.outlook.com (2a01:111:f403:c201::1) by SJ1PEPF00001CDE.mail.protection.outlook.com (2603:10b6:a0f:fc02::106) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Fri, 22 May 2026 00:15:13 +0000
from CWLP265CA0417.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:1b6::7) by DB9PR04MB9626.eurprd04.prod.outlook.com (2603:10a6:10:309::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May 2026 00:15:09 +0000
from AMS1EPF0000003F.eurprd04.prod.outlook.com (2603:10a6:400:1b6:cafe::48) by CWLP265CA0417.outlook.office365.com (2603:10a6:400:1b6::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Fri, 22 May 2026 00:15:09 +0000
from [127.0.0.1] (185.121.176.168) by AMS1EPF0000003F.mail.protection.outlook.com (10.167.16.36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Fri, 22 May 2026 00:15:08 +0000
Received-Spf
Pass (protection.outlook.com: domain of hoeflershop.at designates 2a01:111:f403:c201::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::1; helo=AM0PR83CU005.outbound.protection.outlook.com; pr=C
SoftFail (protection.outlook.com: domain of transitioning hoeflershop.at discourages use of 185.121.176.168 as permitted sender)
Message-Id
attachment-1
- SHA256 3c93708755e2354e00e6784e7a590449eda56d4b25872fd33b22b1e181892432
- MD5 67dfe2b366e0e07ee04454dfe89b354d
- SHA1 37c5f0f8f894a38c11010714f9d389c746b4a931
- SHA512 6797bf9b3e7b5d9cc458b3822579277b399d40ea3374f4007ae49e3b17acdca9f0148532c6895c18a67bf892a4585d19432be3d27ae402317c17455589f080c1
- TLSH T1D951C8D976724B9B04E6E20154F661342C304AD339B3E64232B863A13FFF538DBD1998
- MD5 SHA1 SHA512 TLSH
email-plain-1.txt
- SHA256 26d8a98daf6868c5a00a22288d0a945a1ad29eaca0594862e94c4ffbe1be1f54
- MD5 96be5aa089791b6d836425edccd84f41
- SHA1 a5acf9a30c66866feabb3a26121f37ad1982d4cb
- SHA512 da74f3c8957f2aa2c4161653593f419b8e78a43158ab7214ddee955818c5ff1ad9db1a9e7dd77c282b3176fb5045bc5b97c723bb32847ea05bbb3a2b5ef3dee7
- TLSH T127C08C78AA4A62F2942624A38B4A174B82B0E45406079F04686688DE03E0F28F5F0BD5
- MD5 SHA1 SHA512 TLSH