Overview

overview

4

Static

static

1

sn-knowled...nt.svg

windows10-2004-x64

3

sn-knowled...nt.svg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    6e3b82ba-a1c0-fcaf-1697-7240470346cb.eml
  • Size 56KB
  • Sample260714-e1xkqaes5k
  • SHA256 17f2228f04f2d50c377973fd794b16b2468a13328f1d8b40e4cfd19a4d09e23f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 6e3b82ba-a1c0-fcaf-1697-7240470346cb.eml
    .eml 56KB
  • email-html-1.txt
    .html 19KB
  • image
    .png 1KB
  • sn-knowledge-content.svg
    .svg 1KB

6e3b82ba-a1c0-fcaf-1697-7240470346cb.eml

  • SHA256 17f2228f04f2d50c377973fd794b16b2468a13328f1d8b40e4cfd19a4d09e23f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
0_wAiRO_Zk03@a9!

Email Headers

Return-Path

[email protected]

Date

Mon, 13 Jul 2026 11:36:21 -0700 (PDT)

Subject

Reg: Article KB2930717 has been revised

Content-Type

multipart/related; boundary="----=_Part_59467_384531965.1783967781706"

Received

from SI2PR02CA0026.apcprd02.prod.outlook.com (2603:1096:4:195::19) by KUYPR03MB10263.apcprd03.prod.outlook.com (2603:1096:d10:9a::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Mon, 13 Jul 2026 18:36:25 +0000

from SG2PEPF000B66CF.apcprd03.prod.outlook.com (2603:1096:4:195:cafe::36) by SI2PR02CA0026.outlook.office365.com (2603:1096:4:195::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Mon, 13 Jul 2026 18:36:24 +0000

from outbound41.service-now.com (199.91.139.23) by SG2PEPF000B66CF.mail.protection.outlook.com (10.167.240.23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Mon, 13 Jul 2026 18:36:24 +0000

from app137180.bwi201.service-now.com (app137180.bwi201.service-now.com [10.181.137.180]) by outbound41.service-now.com (Postfix) with ESMTPSA id C0470400009D for <[email protected]>; Mon, 13 Jul 2026 11:36:21 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of service-now.com designates 199.91.139.23 as permitted sender) receiver=protection.outlook.com; client-ip=199.91.139.23; helo=outbound41.service-now.com; pr=E

Message-Id

<[email protected]>

Extracted URLs

  • file https://hi.service-now.com/kb?id=kb_article_view&sys_kb_id=b94839f1874e8b5c57288519dabb357e

  • file https://support.servicenow.com/kb?id=ns_notification_settings&sysparm_domain_restore=false&sysparm_stack=no

  • file https://twitter.com/servicenow

  • file https://www.facebook.com/servicenow

  • file https://www.linkedin.com/company/servicenow

  • file https://www.youtube.com/user/servicenowinc