Overview

overview

1

Static

static

1

=?iso-8859....xls?=

windows10-2004-x64

1

=?iso-8859....xls?=

windows11-ltsc_2024-x64

1

Resubmissions

09/07/2026, 14:19

260709-rm8r2sby6m8

09/07/2026, 14:18

260709-rmgcssby3p1

Sharing

Copy URL Twitter E-mail

General

  • Target
    SOA-0782026_pillowurbanstay.eml
  • Size 250KB
  • Sample260709-rmgcssby3p
  • SHA256 a49812023eb78594915c1e520bf73ff66bac467749947f3e073d729b16f0da77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • SOA-0782026_pillowurbanstay.eml
    .eml 250KB
  • =?iso-8859-1?Q?SOA-T-n=B00782026=5Fpillowurbanstay.xls?=
    .xls?= .xls 173KB
  • email-html-2.txt
    .html 3KB
  • email-plain-1.txt
    484B

SOA-0782026_pillowurbanstay.eml

  • SHA256 a49812023eb78594915c1e520bf73ff66bac467749947f3e073d729b16f0da77
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Thu, 9 Jul 2026 14:01:22 +0000

Subject

SOA-0782026_pillowurbanstay

Content-Type

multipart/mixed; boundary="_004_VE1P194MB08625591A4597CFCA13212BDBBFE2VE1P194MB0862EURP_"

Received

from PA4PR04CU001.outbound.protection.outlook.com (mail-francecentralazon11023116.outbound.protection.outlook.com [40.107.162.116]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-317-ubhwMrPjOVC6uPm_orjPEQ-1; Thu, 09 Jul 2026 15:01:24 +0100

from VE1P194MB0862.EURP194.PROD.OUTLOOK.COM (2603:10a6:800:168::8) by VI0P194MB2964.EURP194.PROD.OUTLOOK.COM (2603:10a6:800:315::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Thu, 9 Jul 2026 14:01:22 +0000

from VE1P194MB0862.EURP194.PROD.OUTLOOK.COM ([fe80::2246:52e4:df75:34e7]) by VE1P194MB0862.EURP194.PROD.OUTLOOK.COM ([fe80::2246:52e4:df75:34e7%5]) with mapi id 15.21.0181.014; Thu, 9 Jul 2026 14:01:22 +0000

Message-Id

<VE1P194MB08625591A4597CFCA13212BDBBFE2@VE1P194MB0862.EURP194.PROD.OUTLOOK.COM>

Extracted URLs

  • file https://url.uk.m.mimecastprotect.com/s/5YmtCPYp2HKAgqk8c0h2fxAvzl?domain=pillowurbanstay.gr

  • file https://url.uk.m.mimecastprotect.com/s/5YmtCPYp2HKAgqk8c0h2fxAvzl?domain=pillowurbanstay.gr/

  • file https://url.uk.m.mimecastprotect.com/s/sfX0COZo1uprYoyzUEfzfG3GMk?domain=pillowurbanstay.gr