Overview

overview

4

Static

static

1

moadh.bukh..._1.eml

windows10-2004-x64

1

moadh.bukh..._1.eml

windows11-ltsc_2024-x64

4

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    moadh.bukhash_2026_07_22_attch_1_of_1.eml
  • Size 46KB
  • Sample260722-g84ecael3x
  • SHA256 d6c8a16150bc4821d1347a46e6795c653aa30346a8bba60a9e61c0c90c531938
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • moadh.bukhash_2026_07_22_attch_1_of_1.eml
    .eml 46KB
  • email-html-2.txt
    .html 17KB
  • email-plain-1.txt
    3KB

moadh.bukhash_2026_07_22_attch_1_of_1.eml

  • SHA256 d6c8a16150bc4821d1347a46e6795c653aa30346a8bba60a9e61c0c90c531938
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

PNYP287MB465231DD87458642C72F286FFAFE2@PNYP287MB4652.INDP287.PROD.OUTLOOK.COM

Return-Path

[email protected]

Date

Mon, 20 Jul 2026 06:59:06 +0000

Subject

Re: Exclusive offer For Aya Hasbini Participation

Content-Type

multipart/alternative; boundary="_000_PNYP287MB465246B62DBA972AAC3E3EFAFAC32PNYP287MB4652INDP_"

Received

from DX3P273MB2081.AREP273.PROD.OUTLOOK.COM (2603:1086:300:8e::7) by DX1P273MB1815.AREP273.PROD.OUTLOOK.COM with HTTPS; Mon, 20 Jul 2026 06:59:27 +0000

from AS4P189CA0050.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:659::28) by DX3P273MB2081.AREP273.PROD.OUTLOOK.COM (2603:1086:300:8e::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 06:59:24 +0000

from AMS0EPF00000193.eurprd05.prod.outlook.com (2603:10a6:20b:659:cafe::29) by AS4P189CA0050.outlook.office365.com (2603:10a6:20b:659::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Mon, 20 Jul 2026 06:59:23 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (91.220.42.227) by AMS0EPF00000193.mail.protection.outlook.com (10.167.16.212) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Mon, 20 Jul 2026 06:59:23 +0000

from MA0PR01CU012.outbound.protection.outlook.com (mail-southindiaazon11021129.outbound.protection.outlook.com [40.107.57.129]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-75-4E-vdhXhNMapjpfgENXAGg-1; Mon, 20 Jul 2026 07:59:19 +0100

from PNYP287MB4652.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:2e3::11) by PN6P287MB5248.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:301::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.16; Mon, 20 Jul 2026 06:59:07 +0000

from PNYP287MB4652.INDP287.PROD.OUTLOOK.COM ([fe80::8a32:54e5:2c8a:899c]) by PNYP287MB4652.INDP287.PROD.OUTLOOK.COM ([fe80::8a32:54e5:2c8a:899c%5]) with mapi id 15.21.0223.015; Mon, 20 Jul 2026 06:59:07 +0000

Received-Spf

Fail (protection.outlook.com: domain of thearabwomenleaders.com does not designate 91.220.42.227 as permitted sender) receiver=protection.outlook.com; client-ip=91.220.42.227; helo=eu-smtp-inbound-delivery-1.mimecast.com;

Message-Id

<PNYP287MB465246B62DBA972AAC3E3EFAFAC32@PNYP287MB4652.INDP287.PROD.OUTLOOK.COM>

Extracted URLs

  • file https://url.uk.m.mimecastprotect.com/s/2RNjC299qInAmqPSnfxf57nv9?domain=thearabwomenleaders.com/