Overview

overview

1

Static

static

1

Pro Safety...t.xlsx

windows10-2004-x64

1

Pro Safety...t.xlsx

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 149KB
  • Sample260805-m9bcvaac52
  • SHA256 381083dd6605d95a88469f43bc2f69efd2c93a7bb6a1cf5fa944a6f9e00b68eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 149KB
  • Pro Safety Management Document.xlsx
    .xlsx 81KB
  • email-html-2.txt
    .html 18KB
  • email-plain-1.txt
    1KB

Message.eml

  • SHA256 381083dd6605d95a88469f43bc2f69efd2c93a7bb6a1cf5fa944a6f9e00b68eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
123456

Email Headers

Return-Path

[email protected]

Date

Wed, 5 Aug 2026 10:29:43 +0000

Subject

SSC Project 45367 - Pro Safety Management

Content-Type

multipart/mixed; boundary="_004_CWXP265MB2918D08C54670D9869CF1AAA94D32CWXP265MB2918GBRP_"

Received

from AS4P250CA0018.EURP250.PROD.OUTLOOK.COM (2603:10a6:20b:5e3::13) by LO6P123MB6456.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2a6::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.19; Wed, 5 Aug 2026 10:29:51 +0000

from AM4PEPF00027A69.eurprd04.prod.outlook.com (2603:10a6:20b:5e3:cafe::77) by AS4P250CA0018.outlook.office365.com (2603:10a6:20b:5e3::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.15 via Frontend Transport; Wed, 5 Aug 2026 10:29:50 +0000

from CWXP265CU009.outbound.protection.outlook.com (52.101.100.121) by AM4PEPF00027A69.mail.protection.outlook.com (10.167.16.87) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Wed, 5 Aug 2026 10:29:50 +0000

from CWXP265MB2918.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:c6::7) by CWLP265MB5284.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:1c4::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.19; Wed, 5 Aug 2026 10:29:44 +0000

from CWXP265MB2918.GBRP265.PROD.OUTLOOK.COM ([fe80::7f1a:86aa:8420:928a]) by CWXP265MB2918.GBRP265.PROD.OUTLOOK.COM ([fe80::7f1a:86aa:8420:928a%6]) with mapi id 15.21.0292.018; Wed, 5 Aug 2026 10:29:43 +0000

Received-Spf

Pass (protection.outlook.com: domain of prosafetymanagement.co.uk designates 52.101.100.121 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.100.121; helo=CWXP265CU009.outbound.protection.outlook.com; pr=C

Message-Id

<CWXP265MB2918D08C54670D9869CF1AAA94D32@CWXP265MB2918.GBRP265.PROD.OUTLOOK.COM>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://www.google.com/maps/place/Pro+Safety+Management+-+Telecommunications+-+Health+%26+Safety+Governance+Consultants/@53.9903454,-1.1003363,15z/data=!4m2!3m1!1s0x0:0x4da873b7aab49c38?sa=X&ved=2ahUKEwi2koTK-P71AhWVmFwKHY-SDwsQ_BJ6BAgmEAU/

  • file https://www.google.com/maps/place/Pro+Safety+Management+-+Telecommunications+-+Health+&+Safety+Governance+Consultants/@53.9903454,-1.1003363,15z/data=!4m2!3m1!1s0x0:0x4da873b7aab49c38?sa=X&ved=2ahUKEwi2koTK-P71AhWVmFwKHY-SDwsQ_BJ6BAgmEAU/