Resubmissions

30/07/2026, 15:12

260730-sk6eksbe483

30/07/2026, 14:44

260730-r39paazepa8

General

  • Target
    vkpPVZpJBDo3OKXITTQOqpCp451Hh8HO_2026-07-30T14_43_48.434Z.eml
  • Size 283KB
  • Sample260730-sk6eksbe48
  • SHA256 cc334ede13dd4b35769e106ac893e019f50e3fb24cb32db97d443525295e5b2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • vkpPVZpJBDo3OKXITTQOqpCp451Hh8HO_2026-07-30T14_43_48.434Z.eml
    .eml 283KB
  • =?iso-8859-1?Q?Dr._Ernst_Dejaco_Rechtsanw=E4lte_GmbH.pdf?=
    .pdf 182KB
  • email-html-2.txt
    12KB
  • email-plain-1.txt
    1KB

vkpPVZpJBDo3OKXITTQOqpCp451Hh8HO_2026-07-30T14_43_48.434Z.eml

  • SHA256 cc334ede13dd4b35769e106ac893e019f50e3fb24cb32db97d443525295e5b2a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 28 Jul 2026 10:51:06 +0000

Subject

=?iso-8859-1?Q?Dr._Ernst_Dejaco_Rechtsanw=E4lte_GmbH?=

Content-Type

multipart/mixed; boundary="_004_DU0PR10MB934753BEE2000D6C80EC428790CB2DU0PR10MB9347EURP_"

Received

from PA1PR02MB11491.eurprd02.prod.outlook.com (2603:10a6:102:4e1::20) by GV1PR02MB8283.eurprd02.prod.outlook.com with HTTPS; Tue, 28 Jul 2026 10:54:05 +0000

from DUZPR01CA0303.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b7::27) by PA1PR02MB11491.eurprd02.prod.outlook.com (2603:10a6:102:4e1::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Tue, 28 Jul 2026 10:53:55 +0000

from DB1PEPF0003922F.eurprd03.prod.outlook.com (2603:10a6:10:4b7:cafe::45) by DUZPR01CA0303.outlook.office365.com (2603:10a6:10:4b7::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Tue, 28 Jul 2026 10:53:55 +0000

from mx07-00009201.pphosted.com (185.132.180.224) by DB1PEPF0003922F.mail.protection.outlook.com (10.167.8.102) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 10:53:55 +0000

from pps.filterd (m0447335.ppops.net [127.0.0.1]) by mx08-00009201.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66SAhbq73008907 for <[email protected]>; Tue, 28 Jul 2026 10:53:54 GMT

from duzpr83cu001.outbound.protection.outlook.com (mail-northeuropeazon11022110.outbound.protection.outlook.com [52.101.66.110]) by mx08-00009201.pphosted.com (PPS) with ESMTPS id 4fpttm82ue-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 28 Jul 2026 10:51:08 +0000 (GMT)

from DU0PR10MB9347.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:59a::6) by AM7PR10MB3843.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:14c::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 10:51:06 +0000

from DU0PR10MB9347.EURPRD10.PROD.OUTLOOK.COM ([fe80::5c93:a8db:5f21:367c]) by DU0PR10MB9347.EURPRD10.PROD.OUTLOOK.COM ([fe80::5c93:a8db:5f21:367c%3]) with mapi id 15.21.0245.012; Tue, 28 Jul 2026 10:51:06 +0000

Received-Spf

Pass (protection.outlook.com: domain of dejaco-law.at designates 52.101.66.110 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.66.110; helo=duzpr83cu001.outbound.protection.outlook.com; pr=C

Message-Id

<DU0PR10MB934753BEE2000D6C80EC428790CB2@DU0PR10MB9347.EURPRD10.PROD.OUTLOOK.COM>

Extracted URLs

  • file http://www.dejaco-law.at/

  • file http://www.dejaco-law.at/__;!!P5FZM7ryyeY!REv7Ytq1Oi2EQ0___QPPmBVZl-qXRgOY5eZ392KDFvbbvEgz0Px7d4CsJeCjyj_aLdL6G484BOpCIvULRgJixbEMbkdG$

  • file http://www.dejaco-law.at__;!!P5FZM7ryyeY!REv7Ytq1Oi2EQ0___QPPmBVZl-qXRgOY5eZ392KDFvbbvEgz0Px7d4CsJeCjyj_aLdL6G484BOpCIvULRgJixX1_sGj8$

  • file https://urldefense.com/v3/__

  • file https://www.dejaco-law.at/datenschutz.html

  • file https://www.dejaco-law.at/datenschutz.html__;!!P5FZM7ryyeY!REv7Ytq1Oi2EQ0___QPPmBVZl-qXRgOY5eZ392KDFvbbvEgz0Px7d4CsJeCjyj_aLdL6G484BOpCIvULRgJixXmnl3IZ$