General

  • Target
    564193f3-cf38-4219-b682-aabb4d024459.eml
  • Size 1.9MB
  • Sample260529-ch8txsaz81
  • SHA256 4111f59fe946be0fc5168eff1d6de80c58c9ea0426683ad4581ff5bc4e90f410
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 564193f3-cf38-4219-b682-aabb4d024459.eml
    .eml 1.9MB
  • CARE All Case - Report.xlsx
    .xlsx 1.4MB
  • email-html-2.txt
    .html 143B
  • email-plain-1.txt
    35B

564193f3-cf38-4219-b682-aabb4d024459.eml

  • SHA256 4111f59fe946be0fc5168eff1d6de80c58c9ea0426683ad4581ff5bc4e90f410
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 28 May 2026 13:02:06 -0700 (PDT)

Subject

Arohia Case - Report

Content-Type

multipart/mixed; boundary="----=_Part_41183_1805521682.1779998526051"

Received

from SY7PR01MB8994.ausprd01.prod.outlook.com (::1) by SY7PR01MB10347.ausprd01.prod.outlook.com with HTTPS; Thu, 28 May 2026 20:11:52 +0000

from ME0P300CA0022.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:20f::20) by SY7PR01MB8994.ausprd01.prod.outlook.com (2603:10c6:10:216::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.14; Thu, 28 May 2026 20:11:14 +0000

from ML1PEPF0000F178.ausprd01.prod.outlook.com (2603:10c6:220:20f:cafe::26) by ME0P300CA0022.outlook.office365.com (2603:10c6:220:20f::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.14 via Frontend Transport; Thu, 28 May 2026 20:11:14 +0000

from mx07-0079a801.pphosted.com (66.159.233.89) by ML1PEPF0000F178.mail.protection.outlook.com (10.167.241.69) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Thu, 28 May 2026 20:11:12 +0000

from pps.filterd (m0380539.ppops.net [127.0.0.1]) by mx07-0079a801.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64SG09qu2175797 for <[email protected]>; Fri, 29 May 2026 08:11:10 +1200

from fwdsmtp.iqhive.com (fwdsmtp181.iqhive.com [202.36.18.1]) by mx07-0079a801.pphosted.com (PPS) with ESMTPS id 4ee7y22rqt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 29 May 2026 08:02:10 +1200 (NZT)

from smtprouter.iqhive.com (swarm2-wtc-wlg [10.1.50.102]) by fwdsmtp.iqhive.com (Postfix) with ESMTPS id E9E80100AB5; Thu, 28 May 2026 20:02:06 +0000 (UTC)

from app130011.mel201.service-now.com (pat-103-23-65-12.service-now.com [103.23.65.12]) by smtprouter.iqhive.com (Postfix) with ESMTP id 2AC75121964; Thu, 28 May 2026 20:02:06 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of servicenow.one.nz designates 202.36.18.1 as permitted sender) receiver=protection.outlook.com; client-ip=202.36.18.1; helo=fwdsmtp.iqhive.com; pr=C

Message-Id

<[email protected]>