111837.zip
- SHA256 2bfccf1221be4c2e1257de10d135aa03ce9b79dc1290105acdba1f89c7943871
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win10v2004-20260513-en
Thu, 30 Jul 2026 09:54:30 +0000
Sie sind zu Drooms eingeladen: TRANSAKTIONS DATENRAUM DEMIRE
text/html; charset=UTF-8
from AM0PR02CA0113.eurprd02.prod.outlook.com (2603:10a6:20b:28c::10) by AM9PR03MB7010.eurprd03.prod.outlook.com (2603:10a6:20b:2de::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Thu, 30 Jul 2026 09:54:31 +0000
from AM3PEPF0000A79B.eurprd04.prod.outlook.com (2603:10a6:20b:28c:cafe::a8) by AM0PR02CA0113.outlook.office365.com (2603:10a6:20b:28c::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Thu, 30 Jul 2026 09:54:31 +0000
from mail-eu-central-01.drooms.com (54.93.168.60) by AM3PEPF0000A79B.mail.protection.outlook.com (10.167.16.106) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 09:54:30 +0000
from fraubuntxwsv03-prd.drooms.com (unknown [193.240.144.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by mail-eu-central-01.drooms.com (Postfix) with ESMTPS id 9F4747E771 for <[email protected]>; Thu, 30 Jul 2026 09:54:30 +0000 (UTC)
from drooms.com (unknown [172.20.11.18]) by fraubuntxwsv03-prd.drooms.com (Postfix) with ESMTP id 8363E4A8F6 for <[email protected]>; Thu, 30 Jul 2026 09:54:30 +0000 (UTC)
Pass (protection.outlook.com: domain of drooms.com designates 54.93.168.60 as permitted sender) receiver=protection.outlook.com; client-ip=54.93.168.60; helo=mail-eu-central-01.drooms.com; pr=C
<6a6b1f5681f78_22a783f0018539e3@fraubuntxwsc04-prd.drooms.com.mail>