General

  • Target
    4aivvneQvTSBlNHwLtR5yhtSpqyT1aVO_2026-07-29T09_01_22.070Z.eml
  • Size 103KB
  • Sample260729-kzeleafd45
  • SHA256 f8cf12fe9b98187d3cd65e32cc1b1c37c06e50024c8507fa911f3808a3ea33d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 4aivvneQvTSBlNHwLtR5yhtSpqyT1aVO_2026-07-29T09_01_22.070Z.eml
    .eml 103KB
  • email-html-1.txt
    .html 80KB

4aivvneQvTSBlNHwLtR5yhtSpqyT1aVO_2026-07-29T09_01_22.070Z.eml

  • SHA256 f8cf12fe9b98187d3cd65e32cc1b1c37c06e50024c8507fa911f3808a3ea33d8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounces+SRS=Lm/[email protected]

Date

Tue, 28 Jul 2026 02:06:26 -0700

Subject

We received your complimentary signs and supplies order

Content-Type

text/html; charset="UTF-8"

Received

from DU0PR02MB9773.eurprd02.prod.outlook.com (2603:10a6:10:44f::19) by PAVPR02MB9748.eurprd02.prod.outlook.com with HTTPS; Tue, 28 Jul 2026 12:52:28 +0000

from DU7P191CA0005.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:54e::28) by DU0PR02MB9773.eurprd02.prod.outlook.com (2603:10a6:10:44f::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Tue, 28 Jul 2026 12:52:23 +0000

from DB1PEPF000509E8.eurprd03.prod.outlook.com (2603:10a6:10:54e:cafe::40) by DU7P191CA0005.outlook.office365.com (2603:10a6:10:54e::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Tue, 28 Jul 2026 12:52:23 +0000

from mx08-00009201.pphosted.com (185.183.28.182) by DB1PEPF000509E8.mail.protection.outlook.com (10.167.242.58) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Tue, 28 Jul 2026 12:52:23 +0000

from pps.filterd (m0447334.ppops.net [127.0.0.1]) by mx08-00009201.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66SCmqhw3187558 for <[email protected]>; Tue, 28 Jul 2026 12:52:22 GMT

from typpr03cu001.outbound.protection.outlook.com (mail-japaneastazon11022111.outbound.protection.outlook.com [52.101.126.111]) by mx08-00009201.pphosted.com (PPS) with ESMTPS id 4fps4y1kt4-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 28 Jul 2026 12:52:21 +0000 (GMT)

from KU4PR02MB9234.apcprd02.prod.outlook.com (2603:1096:d10:79::15) by KUZPR02MB8787.apcprd02.prod.outlook.com (2603:1096:d10:21::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.12; Tue, 28 Jul 2026 12:52:14 +0000

from OS8PR02MB8601.apcprd02.prod.outlook.com (2603:1096:604:2a6::14) by KU4PR02MB9234.apcprd02.prod.outlook.com (2603:1096:d10:79::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 12:52:12 +0000

from OS8PR02MB8601.apcprd02.prod.outlook.com ([fe80::f0e0:62ab:fe54:9c6e]) by OS8PR02MB8601.apcprd02.prod.outlook.com ([fe80::f0e0:62ab:fe54:9c6e%5]) with mapi id 15.21.0245.012; Tue, 28 Jul 2026 12:52:12 +0000

from SI2PR02CA0017.apcprd02.prod.outlook.com (2603:1096:4:194::17) by SE3PR02MB8926.apcprd02.prod.outlook.com (2603:1096:101:2ed::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Tue, 28 Jul 2026 09:06:30 +0000

from OSA0EPF000000CD.apcprd02.prod.outlook.com (2603:1096:4:194:cafe::13) by SI2PR02CA0017.outlook.office365.com (2603:1096:4:194::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Tue, 28 Jul 2026 09:06:29 +0000

from extmta1ipc1.americanexpress.com (139.71.106.169) by OSA0EPF000000CD.mail.protection.outlook.com (10.167.240.59) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 09:06:28 +0000

Received-Spf

Pass (protection.outlook.com: domain of AliciaBoucherinstitute.onmicrosoft.com designates 52.101.126.111 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.126.111; helo=typpr03cu001.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of welcome.americanexpress.com designates 139.71.106.169 as permitted sender) receiver=protection.outlook.com; client-ip=139.71.106.169; helo=extmta1ipc1.americanexpress.com; pr=C

Message-Id

<5A.ED.36701.211786A6@hpgplmomiw06>