Overview

overview

4

Static

static

1

2ebe81db-e...15.eml

windows10-2004-x64

1

2ebe81db-e...15.eml

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

4

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    2ebe81db-e9bd-2307-e178-83cc1a963e15.eml
  • Size 80KB
  • Sample260626-pycsmsct3k
  • SHA256 2189e67cee2911c189b2e96b1171367aa56178ea99ea172d5ea55025ed65c308
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 2ebe81db-e9bd-2307-e178-83cc1a963e15.eml
    .eml 80KB
  • email-html-2.txt
    .html 37KB
  • email-plain-1.txt
    3KB

2ebe81db-e9bd-2307-e178-83cc1a963e15.eml

  • SHA256 2189e67cee2911c189b2e96b1171367aa56178ea99ea172d5ea55025ed65c308
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

Return-Path

[email protected]

Date

Tue, 23 Jun 2026 09:09:38 -0600

Subject

[MARKETING] Last chance: See Appspace Intranet live this week [June 25]

Content-Type

multipart/alternative; boundary="2SRFxuEzDsom=_?:"

Received

from TYZPR04MB7507.apcprd04.prod.outlook.com (2603:1096:405:43::10) by TYZPR04MB8764.apcprd04.prod.outlook.com with HTTPS; Tue, 23 Jun 2026 15:13:44 +0000

from PUZP153CA0016.APCP153.PROD.OUTLOOK.COM (2603:1096:301:c2::18) by TYZPR04MB7507.apcprd04.prod.outlook.com (2603:1096:405:43::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Tue, 23 Jun 2026 15:09:43 +0000

from OSA0EPF000000C6.apcprd02.prod.outlook.com (2603:1096:301:c2:cafe::48) by PUZP153CA0016.outlook.office365.com (2603:1096:301:c2::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.4 via Frontend Transport; Tue, 23 Jun 2026 15:09:43 +0000

from esa2.hc847-16.ap.iphmx.com (139.138.44.82) by OSA0EPF000000C6.mail.protection.outlook.com (10.167.240.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.10 via Frontend Transport; Tue, 23 Jun 2026 15:09:42 +0000

from fq156.mta.exacttarget.com ([13.111.63.156]) by esa2.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jun 2026 08:09:41 -0700

by fq156.mta.exacttarget.com id h7agra2fmd4f for <[email protected]>; Tue, 23 Jun 2026 15:09:38 +0000 (envelope-from <[email protected]>)

Received-Spf

Fail (protection.outlook.com: domain of bounce.s10.mc.pd25.com does not designate 139.138.44.82 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.44.82; helo=esa2.hc847-16.ap.iphmx.com;

Pass (esa2.hc847-16.ap.iphmx.com: domain of [email protected] designates 13.111.63.156 as permitted sender) identity=mailfrom; client-ip=13.111.63.156; receiver=esa2.hc847-16.ap.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:64.132.92.0/24 ip4:64.132.88.0/23 ip4:66.231.80.0/20 ip4:68.232.192.0/20 ip4:199.122.120.0/21 ip4:207.67.38.0/24 ip4:128.17.0.0/20 ip4:128.17.64.0/20 ip4:128.17.128.0/20 ip4:128.17.192.0/20 ip4:128.245.0.0/20 ip4:128.245.64.0/20 ip4:13.111.191.0/24 ip4:128.245.242.0/24 ip4:128.245.243.0/24 ip4:128.245.244.0/24 ip4:128.245.245.0/24 ip4:128.245.246.0/24 ip4:128.245.247.0/24 ip4:128.245.176.0/20 ip4:136.147.224.0/20 ip4:207.67.98.192/27 ip4:207.250.68.0/24 ip4:209.43.22.0/28 ip4:198.245.80.0/20 ip4:136.147.128.0/20 ip4:136.147.176.0/20 ip4:13.111.0.0/16 ip4:161.71.32.0/19 ip4:161.71.64.0/20 ip4:13.110.208.0/21 ip4:13.110.216.0/22 ip4:13.108.16.0/20 ip4:136.146.128.0/20 ip4:129.77.16.0/20 ip4:13.110.224.0/20 ip4:159.92.157.0/24 ip4:159.92.158.0/24 ip4:159.92.159.0/24 ip4:159.92.160.0/24 ip4:159.92.161.0/24 ip4:159.92.162.0/24 ip4:159.92.154.0/24 ip4:128.245.240.0/24 ip4:128.245.241.0/24 ip4:159.92.155.0/24 ip4:159.92.163.0/24 ip4:159.92.164.0/22 ip4:159.92.168.0/21 ip4:128.245.248.0/21 -all"

Message-Id

<[email protected]>

Extracted URLs

  • file http://secure-web.cisco.com/1Wf4o86gNQT4-eJHzxLyhYyGdF0jJ35BxIGUfyIhg5Sk42Sh4zbOo4roxWm5QQtBZ5k8hdlx7qCO76Pb9YassGrYzaD4L0rTCM0vFYc-Yaxp9C4tLRFQmB5sEetbPkZpoFEVXHe6Op0Pjfoj6JinyXq-dfglCkSrAGKxWVQvQ5F0w8eZGesAFU7fyq8ajxyYGyJR3NrRerjy5jvLhQKXOvCfWY5QsUoAfUQit8CQwIiyM-ONcCaQQ3uHu1QfD3kwlRlJZF1PH90WssDFDOos8QCGMnLjc6aWtdP49E6Noe_pyQjFSyztAsJBcCuAQp4OsDl18Eg8NB2lJXgwgBlIdkYKaMJIj_u5sQ2F9k1hYdp97lG65uwbMdv1tK8akac1tTPZaUE9cRsCSE2iV03XK4nivXkEj7owA_GHntvEBAKg63PA9bsgVmAbbXQQiYLCr/l116%3Ahttps%3A%2F%2Finfo.appspace.com%2Fe%2F652073%2Fhoneypot-link-here%2F2s7mm1%2F620537307%2Fh%2FbvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyUe

  • file http://secure-web.cisco.com/1Wf4o86gNQT4-eJHzxLyhYyGdF0jJ35BxIGUfyIhg5Sk42Sh4zbOo4roxWm5QQtBZ5k8hdlx7qCO76Pb9YassGrYzaD4L0rTCM0vFYc-Yaxp9C4tLRFQmB5sEetbPkZpoFEVXHe6Op0Pjfoj6JinyXq-dfglCkSrAGKxWVQvQ5F0w8eZGesAFU7fyq8ajxyYGyJR3NrRerjy5jvLhQKXOvCfWY5QsUoAfUQit8CQwIiyM-ONcCaQQ3uHu1QfD3kwlRlJZF1PH90WssDFDOos8QCGMnLjc6aWtdP49E6Noe_pyQjFSyztAsJBcCuAQp4OsDl18Eg8NB2lJXgwgBlIdkYKaMJIj_u5sQ2F9k1hYdp97lG65uwbMdv1tK8akac1tTPZaUE9cRsCSE2iV03XK4nivXkEj7owA_GHntvEBAKg63PA9bsgVmAbbXQQiYLCr/l116:

  • file http://secure-web.cisco.com/1s0q2ftkBalb0sa4SoA1rjtloLl7QCaeRjrlkfjpcwvod2mWTG02gX3zVXcZWztQOaugRAFwlzuGOCJrPgPRx0UNglTfO1ojOC6Kr-epx2FxMQPMpwAMbo6aKS_njdCJBDovrMBDHNrKI1LWKUTEjm7psjyxtKfPVnZ_zHc1hsWXEdAL2c7uBh4qgtWW2VT9-htiUfl685doQRTAPvWKdpzRmCCqyfI7tzhSKZ6NJel4HQjLEjaqmMAB6orZU_I0X5xLsyyIUUZi8d5HCsBKK8ay4fNTIJbiu6iqjN9VaO1gZmtMPYt00ot_HFyjP6ntGbpiqVoi3OkZB0_tdgaXHe6ZbCDAmpXPVp21GCSVs2poXY7Er9Br1jZjVG44z7W5W3dvruP149uZPc3zYXp8G4Rvz8cfhp9G7cqF2HeguLhobBahKJpP7K5JKdZfrWbZX/l131%3Ahttps%3A%2F%2Finfo.appspace.com%2FlistUnsubscribeHeader%2Fu%2F652073%2Fd9b084ddae3440f913b525ae7c2d03573c5016208b79f0e50108c34f2b94db82%2F620537307116%3Ahttps%3A%2F%2Finfo.appspace.com%2Fe%2F652073%2Fhoneypot-link-here%2F2s7mm1%2F620537307%2Fh%2FbvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyUe

  • file http://secure-web.cisco.com/1s0q2ftkBalb0sa4SoA1rjtloLl7QCaeRjrlkfjpcwvod2mWTG02gX3zVXcZWztQOaugRAFwlzuGOCJrPgPRx0UNglTfO1ojOC6Kr-epx2FxMQPMpwAMbo6aKS_njdCJBDovrMBDHNrKI1LWKUTEjm7psjyxtKfPVnZ_zHc1hsWXEdAL2c7uBh4qgtWW2VT9-htiUfl685doQRTAPvWKdpzRmCCqyfI7tzhSKZ6NJel4HQjLEjaqmMAB6orZU_I0X5xLsyyIUUZi8d5HCsBKK8ay4fNTIJbiu6iqjN9VaO1gZmtMPYt00ot_HFyjP6ntGbpiqVoi3OkZB0_tdgaXHe6ZbCDAmpXPVp21GCSVs2poXY7Er9Br1jZjVG44z7W5W3dvruP149uZPc3zYXp8G4Rvz8cfhp9G7cqF2HeguLhobBahKJpP7K5JKdZfrWbZX/l131:

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://info.appspace.com/e/652073/appspace-/2s7mmf/620537307/h/bvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyU

  • file https://info.appspace.com/e/652073/appspace/2s7mm7/620537307/h/bvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyU

  • file https://info.appspace.com/e/652073/appspace/2s7mmb/620537307/h/bvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyU

  • file https://info.appspace.com/e/652073/c-appspace/2s7mmj/620537307/h/bvG3VuxiivkLVn6DNkTAUcER55T0DyJqz0cIvZzaEyU

  • Show all