Overview

overview

6

Static

static

1

Message.eml

windows11-21h2-x64

6

=?iso-8859....xls?=

windows11-21h2-x64

3

email-html-2.html

windows11-21h2-x64

3

email-plain-1.txt

windows11-21h2-x64

3

image.png

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 291KB
  • Sample260724-kdkwasfb83
  • SHA256 69d46a65ff0146dc46245d93f91a200fc9397ae2045be7e7158e3795c30bc32f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 291KB
  • =?iso-8859-1?Q?SOA-T-n=B00792026=5Fsalugen.xls?=
    .xls?= .xls 173KB
  • email-html-2.txt
    .html 4KB
  • email-plain-1.txt
    520B
  • image.png
    .png 22KB

Message.eml

  • SHA256 69d46a65ff0146dc46245d93f91a200fc9397ae2045be7e7158e3795c30bc32f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 23 Jul 2026 16:16:40 +0000

Subject

SOA-0792026_salugen

Content-Type

multipart/mixed; boundary="_006_PAXPR05MB943526D29CCBD56E627D209DE5C02PAXPR05MB9435eurp_"

Received

from DUZPR01CA0104.eurprd01.prod.exchangelabs.com (2603:10a6:10:4bb::17) by CW1P265MB7457.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:215::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Thu, 23 Jul 2026 16:16:47 +0000

from DB1PEPF000509FC.eurprd03.prod.outlook.com (2603:10a6:10:4bb:cafe::55) by DUZPR01CA0104.outlook.office365.com (2603:10a6:10:4bb::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.11 via Frontend Transport; Thu, 23 Jul 2026 16:16:47 +0000

from OSPPR02CU001.outbound.protection.outlook.com (2a01:111:f403:c20f::7) by DB1PEPF000509FC.mail.protection.outlook.com (2603:10a6:18:3::6d6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Thu, 23 Jul 2026 16:16:47 +0000

from PAXPR05MB9435.eurprd05.prod.outlook.com (2603:10a6:102:2c2::21) by AS2PR05MB10754.eurprd05.prod.outlook.com (2603:10a6:20b:64c::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Thu, 23 Jul 2026 16:16:41 +0000

from PAXPR05MB9435.eurprd05.prod.outlook.com ([fe80::d2e9:e44c:df4:a347]) by PAXPR05MB9435.eurprd05.prod.outlook.com ([fe80::d2e9:e44c:df4:a347%3]) with mapi id 15.21.0245.009; Thu, 23 Jul 2026 16:16:40 +0000

Received-Spf

Pass (protection.outlook.com: domain of salugen.uk designates 2a01:111:f403:c20f::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c20f::7; helo=OSPPR02CU001.outbound.protection.outlook.com; pr=C

Message-Id

<PAXPR05MB943526D29CCBD56E627D209DE5C02@PAXPR05MB9435.eurprd05.prod.outlook.com>

Extracted URLs

  • file https://salugen.uk/

  • file https://substack.com/@salugen

  • file https://www.facebook.com/NatureNurture/

  • file https://www.linkedin.com/in/terri-harrison-4566a966/?lipi=urn%3Ali%3Apage%3Ad_flagship3_profile_view_base_contact_details%3BPQa14T8XThKhayRbgrV8OA%3D%3D