Resubmissions

20/07/2026, 09:27

260720-le7bcsfx8s3

20/07/2026, 09:24

260720-lc3kdsfx2s3

General

  • Target
    Important action requise concernant le renouvellement de votre licence VMware.msg
  • Size 161KB
  • Sample260720-lc3kdsfx2s
  • SHA256 034a84ccde9222b330772d1d2904f32d30a6a3336df9183bc69eeab5f26ec9c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Important action requise concernant le renouvellement de votre licence VMware.msg
    .msg 161KB
  • Notice about your VMware renewal.pdf
    .pdf 60KB

Important action requise concernant le renouvellement de votre licence VMware.msg

  • SHA256 034a84ccde9222b330772d1d2904f32d30a6a3336df9183bc69eeab5f26ec9c3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Sun, 19 Jul 2026 10:02:28 -0500

Subject

Important: action requise concernant le renouvellement de votre licence VMware

Content-Type

multipart/mixed; boundary="0000000000008357a90656f814f4"

Received

from MRZP264MB3146.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:1b::15) by PR0P264MB3128.FRAP264.PROD.OUTLOOK.COM with HTTPS; Sun, 19 Jul 2026 16:49:23 +0000

from MR1P264CA0124.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:50::35) by MRZP264MB3146.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:1b::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.16; Sun, 19 Jul 2026 16:49:20 +0000

from MR1PEPF00000D57.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:50:cafe::5c) by MR1P264CA0124.outlook.office365.com (2603:10a6:501:50::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 16:49:20 +0000

from a-vga-rvega-3-x.dc.aviation (143.196.159.101) by MR1PEPF00000D57.mail.protection.outlook.com (10.167.241.4) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 16:49:20 +0000

from relais-vega.lfpo.aviation-civile.gouv.fr (unknown [172.16.212.30]) by a-vga-rvega-3-x.dc.aviation (Relais VEGA PROD (Postfix)) with ESMTPS id EE63F20009 for <[email protected]>; Sun, 19 Jul 2026 18:49:19 +0200 (CEST)

from relais-vega.lfpo.aviation-civile.gouv.fr (a-vga-relais-01-x.sigp.aviation [172.16.212.30]) by relais-vega.lfpo.aviation-civile.gouv.fr (ESMTP All_to_VEGA) with ESMTP id E87B920090 for <[email protected]>; Sun, 19 Jul 2026 18:49:19 +0200 (CEST)

from relais4.lfpo.aviation-civile.gouv.fr (unknown [172.16.249.220]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by relais-vega.lfpo.aviation-civile.gouv.fr (ESMTP Aiguilleur_VEGA) with ESMTPS id E5E5980137 for <[email protected]>; Sun, 19 Jul 2026 18:49:19 +0200 (CEST)

from localhost (localhost [127.0.0.1]) by relais4.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTP id D6448240450 for <[email protected]>; Sun, 19 Jul 2026 18:49:19 +0200 (CEST)

from relais4.lfpo.aviation-civile.gouv.fr ([127.0.0.1]) by localhost (relais4.lfpo.aviation [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QhVMcQ60Kyr4 for <[email protected]>; Sun, 19 Jul 2026 18:49:19 +0200 (CEST)

from mail-pg1-f228.google.com (mail-pg1-f228.google.com [209.85.215.228]) by relais4.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTPS id 11E8924044F for <[email protected]>; Sun, 19 Jul 2026 18:49:18 +0200 (CEST)

by mail-pg1-f228.google.com with SMTP id 41be03b00d2f7-c9e30214d8fso6695082a12.3 for <[email protected]>; Sun, 19 Jul 2026 09:49:18 -0700 (PDT)

from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-12.dlp.protect.broadcom.com. [144.49.247.12]) by smtp-relay.gmail.com with ESMTPS id a92af1059eb24-13ce2a95de1sm110989c88.5.2026.07.19.08.02.39 for <[email protected]> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 19 Jul 2026 08:02:40 -0700 (PDT)

by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49545071724so32111105e9.0 for <[email protected]>; Sun, 19 Jul 2026 08:02:38 -0700 (PDT)

from 856984315452 named unknown by gmailapi.google.com with HTTPREST; Sun, 19 Jul 2026 10:02:28 -0500

from 856984315452 named unknown by gmailapi.google.com with HTTPREST; Sun, 19 Jul 2026 10:02:28 -0500

X-Received

by 2002:a17:90b:5251:b0:38e:76f8:fcbe with SMTP id 98e67ed59e1d1-38e76f91c80mr2019072a91.29.1784473360189; Sun, 19 Jul 2026 08:02:40 -0700 (PDT)

by 2002:a05:600c:4fc3:b0:495:4a22:d684 with SMTP id 5b1f17b1804b1-4954a3db781mr102994745e9.10.1784473356938; Sun, 19 Jul 2026 08:02:36 -0700 (PDT)

by 2002:a05:600c:4fc3:b0:495:4a22:d684 with SMTP id 5b1f17b1804b1-4954a3db781mr102994185e9.10.1784473356276; Sun, 19 Jul 2026 08:02:36 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of broadcom.com designates 209.85.215.228 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.215.228; helo=mail-pg1-f228.google.com; pr=C

Message-Id

<CAO7CKnPabmha8khYP2Bjxm5nB6AeHmKESpcG6ZtN0xec1AhAYw@mail.gmail.com>

Extracted URLs

  • file http://broadcom.com