General

  • Target
    Message.eml
  • Size 468KB
  • Sample260709-fdstpacw7n
  • SHA256 1590714b363d3fcbf70eff78da0437614fb8ba81a07f57fa673af92e90e3fea0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 468KB
  • email-html-2.txt
    172KB
  • email-plain-1.txt
    34KB
  • image001.png
    .png 32KB
  • image002.png
    .png 126KB

Message.eml

  • SHA256 1590714b363d3fcbf70eff78da0437614fb8ba81a07f57fa673af92e90e3fea0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

In-Reply-To

CAAy9x0f0gjDsks3A8N24mxQmkPNy_7wKy6j5VnTfj8_bY4WgbA@mail.gmail.com

Return-Path

[email protected]

Date

Thu, 9 Jul 2026 11:23:58 +0800

Subject

Re: [Berge Bulk Employment Offer] Technical Training Consultant - Erwin Gringo Laylo

Content-Type

multipart/related; boundary="000000000000676e360656252869"

Received

from SG2PR02CA0126.apcprd02.prod.outlook.com (2603:1096:4:188::11) by JH0PR04MB8088.apcprd04.prod.outlook.com (2603:1096:990:a0::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.10; Thu, 9 Jul 2026 03:24:21 +0000

from SG2PEPF000B66D0.apcprd03.prod.outlook.com (2603:1096:4:188:cafe::54) by SG2PR02CA0126.outlook.office365.com (2603:1096:4:188::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.10 via Frontend Transport; Thu, 9 Jul 2026 03:24:21 +0000

from esa2.hc847-16.ap.iphmx.com (139.138.44.82) by SG2PEPF000B66D0.mail.protection.outlook.com (10.167.240.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Thu, 9 Jul 2026 03:24:20 +0000

from mail-lf1-f46.google.com ([209.85.167.46]) by esa2.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2026 20:24:17 -0700

by mail-lf1-f46.google.com with SMTP id 2adb3069b0e04-5aeb5829fd5so1283156e87.1 for <[email protected]>; Wed, 08 Jul 2026 20:24:15 -0700 (PDT)

X-Received

by 2002:a05:6512:4507:b0:5ae:afec:8afb with SMTP id 2adb3069b0e04-5b01148213emr1155949e87.48.1783567451900; Wed, 08 Jul 2026 20:24:11 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 139.138.44.82 as permitted sender)

Pass (esa2.hc847-16.ap.iphmx.com: domain of [email protected] designates 209.85.167.46 as permitted sender) identity=mailfrom; client-ip=209.85.167.46; receiver=esa2.hc847-16.ap.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all"

Message-Id

<CAAy9x0cK71tK_pypUz1Xau302AFpO2PP-sDThDc8-WD+[email protected]>

Extracted URLs

  • file http://www.bergebulk.com/

  • file https://drive.google.com/drive/folders/1dXq8xUphgpNr9-QNaEByACsKxUZpKGiR?usp=drive_link

  • file https://www.facebook.com/BergeBulkOfficial/

  • file https://www.google.com/maps/search/12+Marina+Boulevard,+%2324?entry=gmail&source=g

  • file https://www.instagram.com/bergebulk/

  • file https://www.linkedin.com/company/berge-bulk/