DownloadedMessage (36).zip
- SHA256 1bf59350bf4f4224c11b98c179c887face9a48e0ddefdc1a0ff18f0b1ae3ee13
Password
123
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
900 seconds
General
- Target DownloadedMessage (36).zip
- Size 44KB
- Sample260622-mvm34aa14k
- SHA256 1bf59350bf4f4224c11b98c179c887face9a48e0ddefdc1a0ff18f0b1ae3ee13
- MD5 131dab1889fe7400a33bb19d6b7c1d8a
- SHA1 a5d05c997aad88bcf90c3435c973fcc056627ca4
- SHA512 d57cda9d64512188b37ec9f9724a74d1e538f945d731b5563a944c1e26d0247ab3c56745dc9cf4335012ffbfcb921d1af3a06199393947733a6977870ba67762
- SSDEEP 768:qhvpzowLG3qJWhXXw5J6zWJMvxDptaTmk+Arg2BlXuwWFJoN5CeguFWaqM4B1:svLcHw5JQrldkr/BxsENsegpO4B1
- TLSH T16A13F1C1E106DA3CD5077BA1EB2BF2F92FCE02509EF61B2E947281D2D5655D9DC4B082
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
DownloadedMessage (36).zip.zip 44KB
-
Message.eml.eml 115KB
-
email-html-2.txt.html 49KB
-
email-plain-1.txt5KB
-
image403935.png.png 14KB
Message.eml
- SHA256 6163fb56c9c43b20ccf0dfe602953dd1f4bd78d1ae2f8029993af1f48fb9ed43
- MD5 4a24bfce5908d4f3d93475ede7071b33
- SHA1 f395b8aeb18e29f2cba7d7dd11bb8732b50a17fc
- SHA512 daff61d627cfaecc34e890c0b758242abcd718bd5bac12fc15d5cf624456a6df6ccaa211c30063c72c8c3689518df6e11c2decfe01b3012c0db0cb114d18ed8c
- SSDEEP 1536:RpKb1QWA8x2lpwTNixBdEAVoETCW4hdtDF8fWpaPlofbD:Rp013x2/SNItAh4jlof3
- TLSH T1E2B39F92065223B8ECE01D02582DB69772737A472CF160CF093E4FE75A526F92DF99C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Email Headers
From
In-Reply-To
LO0P265MB335578C8C6EE95B7248287AAA9E52@LO0P265MB3355.GBRP265.PROD.OUTLOOK.COM
Return-Path
Date
Fri, 19 Jun 2026 08:03:25 +0000
Subject
=?utf-8?B?UmU6IEF1c3RhdXNjaCB6dSBUR0EtRmFjaGtyw6RmdGVu?=
Content-Type
multipart/alternative; boundary="_000_LO0P265MB335541E8B33336B60627AF52A9E22LO0P265MB3355GBRP_"
Received
from DUZP191CA0037.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4f8::9) by MIYPR03MB11831.eurprd03.prod.outlook.com (2603:10a6:290:78::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.11; Fri, 19 Jun 2026 08:03:32 +0000
from DB1PEPF000509F3.eurprd02.prod.outlook.com (2603:10a6:10:4f8:cafe::5d) by DUZP191CA0037.outlook.office365.com (2603:10a6:10:4f8::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.11 via Frontend Transport; Fri, 19 Jun 2026 08:03:30 +0000
from CWXP265CU009.outbound.protection.outlook.com (2a01:111:f403:c206::3) by DB1PEPF000509F3.mail.protection.outlook.com (2603:10a6:18:3::695) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.8 via Frontend Transport; Fri, 19 Jun 2026 08:03:30 +0000
from LO4P123CA0312.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:197::11) by LO2P265MB2479.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:12f::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.11; Fri, 19 Jun 2026 08:03:27 +0000
from LN2PEPF000100CA.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:197:cafe::33) by LO4P123CA0312.outlook.office365.com (2603:10a6:600:197::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.13 via Frontend Transport; Fri, 19 Jun 2026 08:03:27 +0000
from uk2.smtp.exclaimer.net (51.141.5.228) by LN2PEPF000100CA.mail.protection.outlook.com (10.167.240.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.8 via Frontend Transport; Fri, 19 Jun 2026 08:03:27 +0000
from LO2P265CU024.outbound.protection.outlook.com (40.93.67.29) by uk2.smtp.exclaimer.net (51.141.5.228) with Exclaimer Signature Manager ESMTP Proxy uk2.smtp.exclaimer.net (tlsversion=TLS12, tlscipher=TLS_DIFFIEHELLMAN_WITH_AES256_NONE); Fri, 19 Jun 2026 08:03:27 +0000
from LO0P265MB3355.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:16c::7) by LO0P265MB2617.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:14e::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.11; Fri, 19 Jun 2026 08:03:25 +0000
from LO0P265MB3355.GBRP265.PROD.OUTLOOK.COM ([fe80::9e5c:878c:db71:355e]) by LO0P265MB3355.GBRP265.PROD.OUTLOOK.COM ([fe80::9e5c:878c:db71:355e%2]) with mapi id 15.21.0139.011; Fri, 19 Jun 2026 08:03:25 +0000
Received-Spf
Pass (protection.outlook.com: domain of thex4group.com designates 2a01:111:f403:c206::3 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c206::3; helo=CWXP265CU009.outbound.protection.outlook.com; pr=C
Pass (protection.outlook.com: domain of thex4group.com designates 51.141.5.228 as permitted sender) receiver=protection.outlook.com; client-ip=51.141.5.228; helo=uk2.smtp.exclaimer.net; pr=C
Message-Id
<LO0P265MB335541E8B33336B60627AF52A9E22@LO0P265MB3355.GBRP265.PROD.OUTLOOK.COM>
Extracted URLs
-
file http://www.x4alpha.com/
-
file https://aka.ms/LearnAboutSenderIdentification
-
file https://sw.thex4group.com/img/bym7jpzrg2txybcgedda0cctzt1o9gt0yuuksw]
-
file https://sw.thex4group.com/lnk/ayjihjcld_-bh9-t6pltlz7bxau3zcdxqqbvoq
-
file https://sw.thex4group.com/lnk/fot5holkswvmmkgdvem8zse48xnq965ciowl
-
file https://sw.thex4group.com/lnk/hmiqng1ckfh76zdrgt-3lsmckfshcnvwit5vag
-
file https://sw.thex4group.com/lnk/lnohiplync10re4mdivhhd4p-5czoh8hwj-s
-
file https://sw.thex4group.com/lnk/lqzwraecnz33n4fqs9qx4t--m1znw-pyljrax58
-
file https://sw.thex4group.com/lnk/mygpm8ordnixxwexdzml9iffhsbebg5in7negxxvhg
-
file https://sw.thex4group.com/lnk/tedukt89xoqqjdm2y3-xuz8e2a6wjpfermchq-hk
-
file https://sw.thex4group.com/lnk/xndrrfsfatz-ttb1qs-xquarblssrtv_hky
-
file https://sw.thex4group.com/lnk/zpkvuzt3ftiyewmecgm_pthos-_f4i0u4g
-
file https://www.linkedin.com/company/x4engineering/
-
file https://www.linkedin.com/in/denzel-bischoff/
-
file https://www.thex4group.com/privacy-policy/
-
file https://www.thex4group.com/unsubscribe/
-
file https://www.x4engineering.com/
- Show all
email-html-2.txt
- SHA256 ad3fd9c8b52610bed64421e5f803af842f75c3901ed7d3e4784c2104090291d2
- MD5 9915290e4c159a9bfcefac9ec6c43a18
- SHA1 7c8480be890763c9f9e1361b1bf5ef6c3c7ae34e
- SHA512 e89792bc7c65f3e5620842a03a5c0af72a053386ec52241bba5ef2398018c416520add2dfe0b18f7eb8d4a82bb73e09b288ca2c624b1a3b190d3243e1c7e2327
- SSDEEP 768:J7BmOTc1wTlIgDFe3mm/Q5TyFRJfcme6eONQwNvJnR5AzuY9ff:J7BmOTc1wTaJmdTmWmRAzFxf
- TLSH T19B331213F3801D1689BE5834F0136BBCBB7815DA9B611DB0919B6B3F5B8DCB24293798
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 fa705ccf58634e83a4f013192364b493cc1ba950d3aa7adf4050b035801ffd86
- MD5 4f05e3ab50fe9237656f14edf806256f
- SHA1 05b2539eb8eacf78b004f8a31b6d278917ebdb70
- SHA512 66a8d767fda589a4bfd9fc42ffce3578e21deed98dde18340599fabd8e7f43feb6112c1fd088bee76a05840a03c468754e9dae203dfac2e9ef9893aa73791d38
- SSDEEP 96:9FfeksLDxu5WefsM4hqw7mhAKCDy7CI2OmAhTdEltLQ7vyAXAkt0QriFyug0UWem:nf5sDxIPfeIJGy7WARdETLQrVAkt0QmF
- TLSH T1E0C11BBF5BD60A584F4511F0B40BB9C9FE12012CDBADC5AAB09D435A87058BB927D7C8
- MD5 SHA1 SHA512 SSDEEP TLSH
image403935.png
- SHA256 74d20edf4497244aaf29dd1a22a7b65e4ca582c230140cd42dfff733f39ada76
- MD5 c4cb6e165941c85eb8395a9707c6ee6c
- SHA1 86ad8f902230b483aa1d9a05fb28d7e70b37f259
- SHA512 e5484535c54020431ab444441f9e08c46433ac1e2e3915ceeff6223877d227fa2de2979da068fb4b37a717a52c7dce5f738cfbe7bafb91c129adc45f78905a27
- SSDEEP 384:5vvhghWwMbEi1ejBIY0clSq1Kgwhnra3fK3y35d:lvhgtMYikL0qSowhWii35d
- TLSH T10552C0D6F1CE51C8BBC333B5EB986F8B5F514A776CD0AC741A89819214B0B9C3491B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123