Overview

overview

3

Static

static

1

=?iso-8859....xls?=

windows11-21h2-x64

3

=?iso-8859....xls?=

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 255KB
  • Sample260723-rhryqsbd44
  • SHA256 ab9d4a74d1317b2cad723747c786ec535c3d0a6735033ee381b2067716ead6cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 255KB
  • =?iso-8859-1?Q?SOA-T-n=B00792026=5Flinksnurserybalmedie.xls?=
    .xls?= .xls 173KB
  • email-html-2.txt
    .html 1KB
  • email-plain-1.txt
    66B

Message.eml

  • SHA256 ab9d4a74d1317b2cad723747c786ec535c3d0a6735033ee381b2067716ead6cf
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 21 Jul 2026 07:15:34 +0000

Subject

SOA-0792026_linksnurserybalmedie

Content-Type

multipart/mixed; boundary="_004_LO4P123MB525508930B733250FD94876493C22LO4P123MB5255GBRP_"

Received

from DUZPR01CA0302.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b7::19) by CWLP265MB3297.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:e1::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 07:15:37 +0000

from DU2PEPF00028D0D.eurprd03.prod.outlook.com (2603:10a6:10:4b7:cafe::8) by DUZPR01CA0302.outlook.office365.com (2603:10a6:10:4b7::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.10 via Frontend Transport; Tue, 21 Jul 2026 07:15:37 +0000

from CWXP265CU009.outbound.protection.outlook.com (2a01:111:f403:c206::3) by DU2PEPF00028D0D.mail.protection.outlook.com (2603:10a6:18:3::6c5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Tue, 21 Jul 2026 07:15:36 +0000

from LO4P123MB5255.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:1fd::11) by LOAP123MB8655.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:499::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 07:15:34 +0000

from LO4P123MB5255.GBRP123.PROD.OUTLOOK.COM ([fe80::ebf0:9086:219a:64d3]) by LO4P123MB5255.GBRP123.PROD.OUTLOOK.COM ([fe80::ebf0:9086:219a:64d3%4]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 07:15:34 +0000

Received-Spf

Pass (protection.outlook.com: domain of linksnurserybalmedie.co.uk designates 2a01:111:f403:c206::3 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c206::3; helo=CWXP265CU009.outbound.protection.outlook.com; pr=C

Message-Id

<LO4P123MB525508930B733250FD94876493C22@LO4P123MB5255.GBRP123.PROD.OUTLOOK.COM>