Overview

overview

3

Static

static

1

suspected_...2).eml

windows10-2004-x64

3

suspected_...2).eml

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    suspected_phishing_email (2).eml
  • Size 33KB
  • Sample260720-vrhcfaaz51
  • SHA256 9306736b970f50b5e8660d3c9a905ed4f546ce30c11ee12ffdf4643715fabab1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • suspected_phishing_email (2).eml
    .eml 33KB
  • email-html-1.txt
    .html 25KB

suspected_phishing_email (2).eml

  • SHA256 9306736b970f50b5e8660d3c9a905ed4f546ce30c11ee12ffdf4643715fabab1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 08 Jul 2026 17:52:32 GMT

Wed, 8 Jul 2026 17:52:22 +0000

Subject

Security Alert from Microsoft Word

Security Alert from Microsoft Word

Content-Type

text/html; charset=UTF-8

Received

from MW4PR04MB7252.namprd04.prod.outlook.com (2603:10b6:303:76::13) by PH0PR04MB7286.namprd04.prod.outlook.com with HTTPS; Wed, 8 Jul 2026 17:52:32 +0000

from SJ0PR03CA0389.namprd03.prod.outlook.com (2603:10b6:a03:3a1::34) by MW4PR04MB7252.namprd04.prod.outlook.com (2603:10b6:303:76::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.14; Wed, 8 Jul 2026 17:52:27 +0000

from SJ1PEPF00001CDD.namprd05.prod.outlook.com (2603:10b6:a03:3a1:cafe::70) by SJ0PR03CA0389.outlook.office365.com (2603:10b6:a03:3a1::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.10 via Frontend Transport; Wed, 8 Jul 2026 17:52:24 +0000

from smtp.pii-protect.com (54.209.51.230) by SJ1PEPF00001CDD.mail.protection.outlook.com (10.167.242.5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Wed, 8 Jul 2026 17:52:23 +0000

from 169.254.37.253 (10.100.3.79) by smtp.pii-protect.com id h9q75c35vggl for <[email protected]>; Wed, 8 Jul 2026 17:52:22 +0000 (envelope-from <[email protected]>)

Received-Spf

Pass (protection.outlook.com: domain of cloud-service-care.com designates 54.209.51.230 as permitted sender) receiver=protection.outlook.com; client-ip=54.209.51.230; helo=smtp.pii-protect.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file http://https/cloud-service-care.com/render-template/?csu=agYEaGGE&status_id=n

  • file https://cloud-service-care.com/render-template/?csu=agYEaGGE&status_id=n