General

  • Target
    helen.keeley_2026_07_23_attch_1_of_1.eml
  • Size 190KB
  • Sample260723-hj53bashkb
  • SHA256 f987eafb3c44c240545a812ee01f19ffb475218499cc3b47e22c2be9cb81d8ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • helen.keeley_2026_07_23_attch_1_of_1.eml
    .eml 190KB
  • QR_Access_Document_9645d.pdf
    .pdf 134KB
  • email-html-2.txt
    .html 1KB
  • email-plain-1.txt
    49B

helen.keeley_2026_07_23_attch_1_of_1.eml

  • SHA256 f987eafb3c44c240545a812ee01f19ffb475218499cc3b47e22c2be9cb81d8ad
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounces+8255560-25b1-helen.keeley=damanhealth.ae@em9926.frenchmarketinn.com

Date

Wed, 22 Jul 2026 14:47:56 +0000

Subject

Document Approval Request - Docusign_9645dd494476e125

Content-Type

multipart/mixed; boundary="09d63d0b6e8a3918521095132cec4ce76fa2d61641a4402e399c361fe6b9"

Received

from Z01V-MZE-MBX6.damanhealth.ae (10.111.40.87) by Z01V-MZE-MBX5.damanhealth.ae (10.111.40.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37 via Mailbox Transport; Wed, 22 Jul 2026 18:48:32 +0400

from Z01V-MZE-MBX7.damanhealth.ae (10.111.40.88) by Z01V-MZE-MBX6.damanhealth.ae (10.111.40.87) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Wed, 22 Jul 2026 18:48:31 +0400

from mail3.damanhealth.ae (172.27.11.34) by Z01V-MZE-MBX7.damanhealth.ae (10.111.40.88) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37 via Frontend Transport; Wed, 22 Jul 2026 18:48:31 +0400

from s.wfbtzbpn.outbound-mail.sendgrid.net (s.wfbtzbpn.outbound-mail.sendgrid.net [159.183.235.50]) by mail3.damanhealth.ae with ESMTPS id 66MElvLT030758-66MElvLV030758 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for <[email protected]>; Wed, 22 Jul 2026 18:47:59 +0400

by recvd-canary-5bc9645cb-w24mb with SMTP id recvd-canary-5bc9645cb-w24mb-1-6A60D81C-2F 2026-07-22 14:47:56.457836476 +0000 UTC m=+1097328.944250877

from ODI1NTU2MA (unknown) by geopod-ismtpd-14 (SG) with HTTP id in_mudvJRMyu9p74No1X_Q Wed, 22 Jul 2026 14:47:56.425 +0000 (UTC)

Message-Id

<in_mudvJRMyu9p74No1X_Q@geopod-ismtpd-14>