Overview

overview

8

Static

static

1

Message.eml

windows10-2004-x64

1

Message.eml

windows11-ltsc_2024-x64

8

email-html-2.html

windows10-2004-x64

8

email-html-2.html

windows11-ltsc_2024-x64

4

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 29KB
  • Sample260708-tpblfacs5l
  • SHA256 96386b1ebec5544c5523dec9ed7cb5e0b83263bb6da4d92ea8896510c06bf093
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 29KB
  • email-html-2.txt
    .html 15KB
  • email-plain-1.txt
    390B

Message.eml

  • SHA256 96386b1ebec5544c5523dec9ed7cb5e0b83263bb6da4d92ea8896510c06bf093
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 08 Jul 2026 16:00:30 +0000

Subject

=?UTF-8?Q?=F0=9F=92=8C_New_Special_Invite_From_Buster?=

Content-Type

multipart/alternative; boundary="----=_Part_1593560_1152932498.1783505557290"

Received

from DM6PR05CA0059.namprd05.prod.outlook.com (2603:10b6:5:335::28) by DM4PR13MB5908.namprd13.prod.outlook.com (2603:10b6:8:50::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.11; Wed, 8 Jul 2026 16:00:34 +0000

from SA2PEPF000015CA.namprd03.prod.outlook.com (2603:10b6:5:335:cafe::25) by DM6PR05CA0059.outlook.office365.com (2603:10b6:5:335::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.3 via Frontend Transport; Wed, 8 Jul 2026 16:00:34 +0000

from sonic314-13.consmr.mail.bf2.yahoo.com (74.6.132.123) by SA2PEPF000015CA.mail.protection.outlook.com (10.167.241.200) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Wed, 8 Jul 2026 16:00:33 +0000

from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.bf2.yahoo.com with HTTP; Wed, 8 Jul 2026 16:00:32 +0000

Received-Spf

Pass (protection.outlook.com: domain of yahoo.com designates 74.6.132.123 as permitted sender) receiver=protection.outlook.com; client-ip=74.6.132.123; helo=sonic314-13.consmr.mail.bf2.yahoo.com; pr=C

X-Mailer

WebService/1.1.26086 YMailNovation

Message-Id

<[email protected]>

Extracted URLs

  • file https://cordlalnvitation.one/vi/ScreenConnect.ClientSetup.exe