Resubmissions

01/08/2026, 12:32

260801-pql2caaf648

01/08/2026, 10:48

260801-mwkpcshe668

General

  • Target
    message.eml
  • Size 37KB
  • Sample260801-pql2caaf64
  • SHA256 f711ebd5c245d4d078f6d53687abd3e3fcaa2f7407035a7d5278ae0ec25b8450
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • message.eml
    .eml 37KB
  • Attachment.pdf
    .pdf 14KB
  • Attachment.xls
    510B
  • email-plain-1.txt
    440B

message.eml

  • SHA256 f711ebd5c245d4d078f6d53687abd3e3fcaa2f7407035a7d5278ae0ec25b8450
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

Date

Thu, 30 Jul 2026 20:34:27 +0000

Subject

Statement of Accounts 0001030700

Content-Type

multipart/mixed; boundary="_003_ADR510000003181808009506C27091D31FE1A38AC1CDA6C0F2C6nus_"

Received

from SEZPR01MB4632.apcprd01.prod.exchangelabs.com (2603:1096:101:97::13) by SEZPR01MB7314.apcprd01.prod.exchangelabs.com with HTTPS; Thu, 30 Jul 2026 20:35:03 +0000

from PSBPR02CA0007.apcprd02.prod.outlook.com (2603:1096:301::17) by SEZPR01MB4632.apcprd01.prod.exchangelabs.com (2603:1096:101:97::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.15; Thu, 30 Jul 2026 20:34:44 +0000

from TY2PEPF0000AB85.apcprd03.prod.outlook.com (2603:1096:301:0:cafe::9c) by PSBPR02CA0007.outlook.office365.com (2603:1096:301::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.13 via Frontend Transport; Thu, 30 Jul 2026 20:34:44 +0000

from repost01.tmes.trendmicro.com (18.208.22.148) by TY2PEPF0000AB85.mail.protection.outlook.com (10.167.253.5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 20:34:43 +0000

from 40.93.129.53_.trendmicro.com (unknown [192.168.195.57]) by repost01.tmes.trendmicro.com (Postfix) with SMTP id D44AFC00043C for <[email protected]>; Thu, 30 Jul 2026 20:34:41 +0000 (UTC)

from SI4PR04CU001.outbound.protection.outlook.com (unknown [40.93.129.53]) by repre01.tmes.trendmicro.com (Trend Micro Email Security) with ESMTPS id A99ADC002603 for <[email protected]>; Thu, 30 Jul 2026 20:34:39 +0000 (UTC)

from SI2PR01CA0005.apcprd01.prod.exchangelabs.com (2603:1096:4:191::23) by OSNPR06MB8225.apcprd06.prod.outlook.com (2603:1096:604:45f::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.15; Thu, 30 Jul 2026 20:34:30 +0000

from OSA0EPF000000CD.apcprd02.prod.outlook.com (2603:1096:4:191:cafe::1f) by SI2PR01CA0005.outlook.office365.com (2603:1096:4:191::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.13 via Frontend Transport; Thu, 30 Jul 2026 20:34:30 +0000

from nusitddei07.localdomain (137.132.14.10) by OSA0EPF000000CD.mail.protection.outlook.com (10.167.240.59) with Microsoft SMTP Server id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 20:34:29 +0000

from nusitddei07.localdomain (unknown [127.0.0.1]) by DDEI (Postfix) with ESMTP id 27E5BC4224B for <[email protected]>; Fri, 31 Jul 2026 04:34:28 +0800 (CST)

from nusitddei07.localdomain (unknown [127.0.0.1]) by DDEI (Postfix) with ESMTP id 11B6EC42282 for <[email protected]>; Fri, 31 Jul 2026 04:34:28 +0800 (CST)

from HTSMTP52.stf.nus.edu.sg (unknown [137.132.4.108]) by nusitddei07.localdomain (Postfix) with ESMTP for <[email protected]>; Fri, 31 Jul 2026 04:34:28 +0800 (CST)

from HTSMTP51.stf.nus.edu.sg (137.132.4.107) by HTSMTP52.stf.nus.edu.sg (137.132.4.108) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.17; Fri, 31 Jul 2026 04:34:27 +0800

from nus.edu.sg (10.33.67.156) by mail.nus.edu.sg (137.132.4.107) with Microsoft SMTP Server id 15.2.2562.17 via Frontend Transport; Fri, 31 Jul 2026 04:34:27 +0800

Received-Spf

Pass (protection.outlook.com: domain of nus.edu.sg designates 137.132.14.10 as permitted sender) receiver=protection.outlook.com; client-ip=137.132.14.10; helo=nusitddei07.localdomain; pr=C

X-Mailer

SAP NetWeaver 758

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification