tr ATTESTATiON DE PAiEMENT-[.]msg

General

Target
tr ATTESTATiON DE PAiEMENT-.msg
Size 579KB
Sample260804-k474hsbq31
SHA256 127cfd227e9a4e40d2a623e09e65348eb76ad1e96ac4a65fb9db51d1f9d9d716
MD5 127c9507d4fc23aa6c4ef79a77d2cc8f
SHA1 fc084aa692d5cf3660be0015e8a21fb08f40cae0
SHA512 b40114751e8a23b2656486557a95705e3b61bd8c9e6a7ec031582616d55d8c684e50626357d0440a5f0a125528008d8d1ac4cd2b2a7dc4ada86e5881b36e0a95
SSDEEP 12288:hM1X4UitxJEogITwcOpO68OL+IyRpGarE+:lNVgIbOswL+TJE
TLSH
T1B2C45B1359944F47F035C7B4BF930D9A5B1A7E09E8127AEF305E2F8B2B312115C9A62E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

tr ATTESTATiON DE PAiEMENT-.msg

.msg 579KB
2026-07-29 at 09.11. AM.jpg

.jpg 445KB

tr ATTESTATiON DE PAiEMENT-.msg

SHA256 127cfd227e9a4e40d2a623e09e65348eb76ad1e96ac4a65fb9db51d1f9d9d716
MD5 127c9507d4fc23aa6c4ef79a77d2cc8f
SHA1 fc084aa692d5cf3660be0015e8a21fb08f40cae0
SHA512 b40114751e8a23b2656486557a95705e3b61bd8c9e6a7ec031582616d55d8c684e50626357d0440a5f0a125528008d8d1ac4cd2b2a7dc4ada86e5881b36e0a95
SSDEEP 12288:hM1X4UitxJEogITwcOpO68OL+IyRpGarE+:lNVgIbOswL+TJE
TLSH
T1B2C45B1359944F47F035C7B4BF930D9A5B1A7E09E8127AEF305E2F8B2B312115C9A62E
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

From

[email protected]

In-Reply-To

CACt6PgH+[email protected]

Return-Path

[email protected]

Date

Thu, 30 Jul 2026 21:32:29 +0000

Subject

tr : ATTESTATiON DE PAiEMENT-

Content-Type

multipart/mixed; boundary="000000000000ce69cc0657dacf64"

Received

from PASP264MB4964.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:43f::12) by MR1P264MB3668.FRAP264.PROD.OUTLOOK.COM with HTTPS; Thu, 30 Jul 2026 21:32:51 +0000

from PR1P264CA0186.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:344::15) by PASP264MB4964.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:43f::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.15; Thu, 30 Jul 2026 21:32:47 +0000

from PA1PEPF000CC3FC.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:344:cafe::58) by PR1P264CA0186.outlook.office365.com (2603:10a6:102:344::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.15 via Frontend Transport; Thu, 30 Jul 2026 21:32:47 +0000

from a-vga-rvega-3-x.dc.aviation (143.196.159.101) by PA1PEPF000CC3FC.mail.protection.outlook.com (10.167.242.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 21:32:47 +0000

from a-vga-iris-1-x.dc.aviation (unknown [172.16.249.43]) by a-vga-rvega-3-x.dc.aviation (Relais VEGA PROD (Postfix)) with ESMTPS id 6D64C2000D for <[email protected]>; Thu, 30 Jul 2026 23:32:47 +0200 (CEST)

from cs-iris-02.iris.aviation-civile.gouv.fr (unknown [172.30.224.7]) by a-vga-iris-1-x.dc.aviation (Relais IRIS PROD (Postfix)) with ESMTP id 4DD208001B for <[email protected]>; Thu, 30 Jul 2026 23:32:47 +0200 (CEST)

from localhost (localhost [127.0.0.1]) by cs-iris-02.iris.aviation (Postfix) with ESMTP id 360E286687 for <[email protected]>; Thu, 30 Jul 2026 23:32:47 +0200 (CEST)

from cs-iris-02.iris.aviation-civile.gouv.fr ([127.0.0.1]) by localhost (cs-iris-02.iris.aviation-civile.gouv.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 28693-04 for <[email protected]>; Thu, 30 Jul 2026 23:32:47 +0200 (CEST)

from reltranet-03.s2.m2.e2.rie.gouv.fr (smtp3.equipement.iris [172.30.240.8]) by cs-iris-02.iris.aviation (Postfix) with ESMTP id D77DD86686 for <[email protected]>; Thu, 30 Jul 2026 23:32:46 +0200 (CEST)

from localhost (m2-swarm-reltranet-03.mel.edcs.fr [10.167.128.46]) by reltranet-03.s2.m2.e2.rie.gouv.fr (Postfix) with ESMTP id B772D120059 for <[email protected]>; Thu, 30 Jul 2026 23:32:46 +0200 (CEST)

from reltranet-04.s2.m2.e2.rie.gouv.fr ([10.167.128.52]) by localhost (amavis-prod-m2-swarm-reltranet-03.mel.edcs.fr [172.20.226.5]) (amavis, port 10024) with ESMTP id coZ5RZ01MjVG for <[email protected]>; Thu, 30 Jul 2026 23:32:46 +0200 (CEST)

from relternet-01.developpement-durable.gouv.fr (relternet-01.prod.host.edcs.fr [10.167.126.13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by reltranet-04.s2.m2.e2.rie.gouv.fr (Postfix) with ESMTPS id 445FE28005F for <[email protected]>; Thu, 30 Jul 2026 23:32:46 +0200 (CEST)

from localhost (localhost [127.0.0.1]) by relternet-01.developpement-durable.gouv.fr (Postfix) with ESMTP id 29EE13C16E2 for <[email protected]>; Thu, 30 Jul 2026 23:32:46 +0200 (CEST)

from relternet-01.developpement-durable.gouv.fr ([127.0.0.1]) by localhost (relternet-01.ac.cs [127.0.0.1]) (amavis, port 10024) with LMTP id v01bgSnre9qE for <[email protected]>; Thu, 30 Jul 2026 23:32:44 +0200 (CEST)

from mail-yx2-f4.google.com (mail-yx2-f4.google.com [74.125.224.132]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by relternet-01.developpement-durable.gouv.fr (Postfix) with ESMTPS id 656503C16FA for <[email protected]>; Thu, 30 Jul 2026 23:32:43 +0200 (CEST)

by mail-yx2-f4.google.com with SMTP id 956f58d0204a3-664dfa166f1so151806d50.0 for <[email protected]>; Thu, 30 Jul 2026 14:32:43 -0700 (PDT)

X-Received

by 2002:a05:690c:450e:b0:81e:7b95:c777 with SMTP id 00721157ae682-81fb8b369c7mr34932817b3.35.1785447161135; Thu, 30 Jul 2026 14:32:41 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of student.edgemont.org designates 74.125.224.132 as permitted sender) receiver=protection.outlook.com; client-ip=74.125.224.132; helo=mail-yx2-f4.google.com; pr=C

Pass (mailfrom) identity=mailfrom; client-ip=74.125.224.132; helo=mail-yx2-f4.google.com; [email protected]; receiver=<UNKNOWN>

Message-Id

<CACt6PgFGhcAkT_8CF_zNERsRkMgtbnKae28X-oSXFaG-3w1ong@mail.gmail.com>

Sharing