Overview

overview

3

Static

static

1

NHS Trust ...TS.eml

windows11-21h2-x64

1

email-html-1.html

windows11-21h2-x64

3

Resubmissions

03/08/2026, 10:18

260803-mcdfyavaqf3

03/08/2026, 09:25

260803-ldsftafp8x3

Sharing

Copy URL Twitter E-mail

General

  • Target
    NHS Trust Compensation Review_DNO.msg
  • Size 443KB
  • Sample260803-mcdfyavaqf
  • SHA256 cf25d3a7c96d330746dea661dc8561fa3bbc63f4f9bdf2256a84b532fb835e96
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • NHS Trust Compensation Review_DNO.msg
    .msg 443KB
  • ATT00001.jpg
    .jpg 22KB
  • NHS Trust EMPLOYEE BENEFITS.eml
    .eml 325KB
  • email-html-1.txt
    .html 142KB

NHS Trust Compensation Review_DNO.msg

  • SHA256 cf25d3a7c96d330746dea661dc8561fa3bbc63f4f9bdf2256a84b532fb835e96
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 31 Jul 2026 14:50:26 +0000

Subject

NHS Trust Compensation Review

Content-Type

multipart/mixed; boundary="s5ayJUgRyadfUKT1PQDgyghFE3cI3CiII1BFYQlg"

Received

from CWLP265MB5818.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:1b3::8) by CW1P265MB8654.GBRP265.PROD.OUTLOOK.COM with HTTPS; Fri, 31 Jul 2026 14:50:38 +0000

from LO2P265CA0490.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13a::15) by CWLP265MB5818.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:1b3::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.16; Fri, 31 Jul 2026 14:50:32 +0000

from LO1PEPF000022FF.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13a:cafe::48) by LO2P265CA0490.outlook.office365.com (2603:10a6:600:13a::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.15 via Frontend Transport; Fri, 31 Jul 2026 14:50:32 +0000

from PH7PR06CU001.outbound.protection.outlook.com (52.101.201.85) by LO1PEPF000022FF.mail.protection.outlook.com (10.167.240.23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Fri, 31 Jul 2026 14:50:31 +0000

from SJ0PR03CA0147.namprd03.prod.outlook.com (2603:10b6:a03:33c::32) by EAYPR15MB962159.namprd15.prod.outlook.com (2603:10b6:303:2df::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.16; Fri, 31 Jul 2026 14:50:27 +0000

from MWH0EPF000A6735.namprd04.prod.outlook.com (2603:10b6:a03:33c:cafe::7d) by SJ0PR03CA0147.outlook.office365.com (2603:10b6:a03:33c::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.16 via Frontend Transport; Fri, 31 Jul 2026 14:50:27 +0000

from testy-delay (96.9.214.111) by MWH0EPF000A6735.mail.protection.outlook.com (10.167.249.27) with Microsoft SMTP Server id 15.21.292.8 via Frontend Transport; Fri, 31 Jul 2026 14:50:27 +0000

Received-Spf

Pass (protection.outlook.com: domain of rccmhc.org designates 52.101.201.85 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.201.85; helo=PH7PR06CU001.outbound.protection.outlook.com; pr=C

Fail (protection.outlook.com: domain of rccmhc.org does not designate 96.9.214.111 as permitted sender) receiver=protection.outlook.com; client-ip=96.9.214.111; helo=testy-delay;

Message-Id

<72f61f83-3913-4b81-b39e-b0d5fc3a8903@MWH0EPF000A6735.namprd04.prod.outlook.com>

Extracted URLs

  • file http://NHS.net

  • file http://rccmhc.org

  • file https://aka.ms/LearnAboutSenderIdentification