09e1ce79-3069-3aba-b463-22b50343337e[.]eml

Resubmissions

06/08/2026, 10:09

260806-l6vrmsydre8

06/08/2026, 09:48

260806-ls2m2aybnb8

Sharing

Copy URL Twitter E-mail

General

Target
09e1ce79-3069-3aba-b463-22b50343337e.eml
Size 186KB
Sample260806-ls2m2aybnb
SHA256 759c3ab713418b496742b187a7ed8d756da731f80990fae28a503318045361de
MD5 a48338a288d486d65f077a2e1aa8fa25
SHA1 585e2736988713515d25b6c8f85535f2d8e2b030
SHA512 4f8eb9fab82223d23fb17a0011df3c308d04a90de506deb967b4374baa0a04bce00fba0bbc110385deacfdf64e271bc3a8f735f30c142d81f9e6f1d6fbbf10e7
SSDEEP 3072:b+ByZmTs2iP9SkWFJFU3bYZZ9mU18slHeF:b+ByYTDKokiJFN9mCx2
TLSH
T1AE14D06D8E731C57461272D82954BD0B00E41D9BD56380F439A6B7A30FCF2AEEB5770A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

svg javascript

Malware Config

Signatures

Suspicious SVG script tag 1 IoCs

svg javascript

resource
analyses/260806/260806-ls2m2aybnb/static1/unpack002/PLAY_Voice-+65-360-3928135865.svg

SVG contains script element(s) 1 IoCs

svg javascript

resource
analyses/260806/260806-ls2m2aybnb/static1/unpack002/PLAY_Voice-+65-360-3928135865.svg

File Explorer

09e1ce79-3069-3aba-b463-22b50343337e.eml

.eml 186KB
attachment-3

.eml 18KB
PLAY_Voice-+65-360-3928135865.svg

.svg .js .xml 3KB
PLAY_Voice-+65-360-9788480939.svg

.svg .js .xml 3KB
attachment-4

.eml 18KB
PLAY_Voice-+65-360-2895206583.svg

.svg .js .xml 3KB
PLAY_Voice-+65-360-6835153703.svg

.svg .js .xml 3KB
attachment-5

.eml 18KB
PLAY_Voice-+65-360-6062651018.svg

.svg .js .xml 3KB
PLAY_Voice-+65-360-8145634681.svg

.svg .js .xml 3KB
attachment-6

.eml 18KB
email-html-2.txt

.html 8KB
email-plain-1.txt

437B
image001.png

.png 62KB

09e1ce79-3069-3aba-b463-22b50343337e.eml

SHA256 759c3ab713418b496742b187a7ed8d756da731f80990fae28a503318045361de
MD5 a48338a288d486d65f077a2e1aa8fa25
SHA1 585e2736988713515d25b6c8f85535f2d8e2b030
SHA512 4f8eb9fab82223d23fb17a0011df3c308d04a90de506deb967b4374baa0a04bce00fba0bbc110385deacfdf64e271bc3a8f735f30c142d81f9e6f1d6fbbf10e7
SSDEEP 3072:b+ByZmTs2iP9SkWFJFU3bYZZ9mU18slHeF:b+ByYTDKokiJFN9mCx2
TLSH
T1AE14D06D8E731C57461272D82954BD0B00E41D9BD56380F439A6B7A30FCF2AEEB5770A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

[email protected]

From

[email protected]

Return-Path

[email protected]

Date

Tue, 28 Jul 2026 12:51:48 +0000

Subject

Suspicious emails received by A2Z Private Capital

Content-Type

multipart/mixed; boundary="_009_KL1PR0401MB421150205AF991D99E1CE90FE0CB2KL1PR0401MB4211_"

Received

from SI3PR03CA0007.apcprd03.prod.outlook.com (2603:1096:4:297::18) by TYZPR03MB6496.apcprd03.prod.outlook.com (2603:1096:400:1c7::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Tue, 28 Jul 2026 12:51:56 +0000

from SG2PEPF000B66C9.apcprd03.prod.outlook.com (2603:1096:4:297:cafe::25) by SI3PR03CA0007.outlook.office365.com (2603:1096:4:297::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Tue, 28 Jul 2026 12:51:55 +0000

from OS8PR02CU002.outbound.protection.outlook.com (2a01:111:f403:c406::3) by SG2PEPF000B66C9.mail.protection.outlook.com (2603:1096:f:fff6::57) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 12:51:54 +0000

from KL1PR0401MB4211.apcprd04.prod.outlook.com (2603:1096:820:2a::5) by KL1PR04MB7105.apcprd04.prod.outlook.com (2603:1096:820:f8::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 12:51:48 +0000

from KL1PR0401MB4211.apcprd04.prod.outlook.com ([fe80::ab48:5ac:8f51:4d0a]) by KL1PR0401MB4211.apcprd04.prod.outlook.com ([fe80::ab48:5ac:8f51:4d0a%5]) with mapi id 15.21.0270.009; Tue, 28 Jul 2026 12:51:48 +0000

Received-Spf

Pass (protection.outlook.com: domain of a2zprivcap.com designates 2a01:111:f403:c406::3 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c406::3; helo=OS8PR02CU002.outbound.protection.outlook.com; pr=C

Message-Id

<KL1PR0401MB421150205AF991D99E1CE90FE0CB2@KL1PR0401MB4211.apcprd04.prod.outlook.com>

Extracted URLs

file http://www.a2zprivcap.com/

attachment-3

SHA256 7aae321e5b3a6192d5db44ae9407c30d61639398a0050d10b86d9769ed52cbe1
MD5 fb528d14fcc1686dba3e4d7d515d9e86
SHA1 fe45d76b0c8c18bc92490fabf4f61b50ae2b103a
SHA512 10ba3472bc38ffd6458e6c7096332dab99987ac3bab7aad343cc0ef7449cce88362ff08ce8fad254b9f90de806d7adaee3b239e61a9fcad8bb01c1a1c3803476
SSDEEP 384:y4Ncm1F8VHqiUXTcl+ErDXzrPK8rDRiJSJKxiKVf+ErDXzrPK8rDRiJSJKxiKVS:yecm162XTcJ3K8rD2Bj3K8rD2BS
TLSH
T163828DBE9F730E528A1163C81ED4B81F01652CE799A384FD3956978607CF16CDB2570E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

[email protected]

From

[email protected]

Date

Tue, 28 Jul 2026 07:40:26 +0000

Subject

mCaller left Aschmitz - 34s Preview vHC- July 28, 2026 +65714351

Content-Type

multipart/mixed; boundary="_003_17852244262269a3995816c9b7da2JFZGS42DN5WW25LONFRWC5DJN5_"

Received

from SI4PR04MB9568.apcprd04.prod.outlook.com (2603:1096:4:2ae::19) by KL1PR0401MB4211.apcprd04.prod.outlook.com with HTTPS; Tue, 28 Jul 2026 07:41:00 +0000

from TYCP286CA0041.JPNP286.PROD.OUTLOOK.COM (2603:1096:400:29d::16) by SI4PR04MB9568.apcprd04.prod.outlook.com (2603:1096:4:2ae::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 07:40:30 +0000

from TY2PEPF0000AB86.apcprd03.prod.outlook.com (2603:1096:400:29d:cafe::26) by TYCP286CA0041.outlook.office365.com (2603:1096:400:29d::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Tue, 28 Jul 2026 07:40:30 +0000

from mta-80-125.sparkpostmail.com (94.26.3.115) by TY2PEPF0000AB86.mail.protection.outlook.com (10.167.253.10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 07:40:27 +0000

Received-Spf

None (protection.outlook.com: mta-80-125.sparkpostmail.com does not designate permitted sender hosts)

Message-Id

<[1785224426226.9a3995816c9b7da2-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@a2zprivcap.com]>

attachment-4

SHA256 294a257b92f8c846e59c43725493f5687f211269e49894d5098741951b1fd044
MD5 edf8db33b0e1d274f38c39ee9347642b
SHA1 8b0208f0a3043f52b5b75783d79a004884973f79
SHA512 97c655e9378a10df61cc802bde9965a7cbb3e909dc84332487525b467c081d9e177205b6a1eca8ea97f4975abfb96ccff9298bb8bdd9388b73781e88ba0838f0
SSDEEP 384:K1/fm1FZcuWwt67+ErDXzrPK8rDRiJSJKxiKVm+ErDXzrPK8rDRiJSJKxiKV5:KBfm1rKn3K8rD2BE3K8rD2B5
TLSH
T11E828EBD8E730E428A1273C81A94B81F01A42CD794E394F93D7B53960B8F2ADDB5570E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

[email protected]

From

[email protected]

Date

Tue, 28 Jul 2026 07:27:25 +0000

Subject

mCaller left Aschmitz - 34s Preview vHC- July 28, 2026 +65184268

Content-Type

multipart/mixed; boundary="_003_178522364522792788406591589c5JFZGS42DN5WW25LONFRWC5DJN5_"

Received

from SE2PPF7C43A93DC.apcprd04.prod.outlook.com (2603:1096:108:1::619) by KL1PR0401MB4211.apcprd04.prod.outlook.com with HTTPS; Tue, 28 Jul 2026 07:27:48 +0000

from PSBPR02CA0013.apcprd02.prod.outlook.com (2603:1096:301::23) by SE2PPF7C43A93DC.apcprd04.prod.outlook.com (2603:1096:108:1::619) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.8; Tue, 28 Jul 2026 07:27:28 +0000

from TY2PEPF0000AB88.apcprd03.prod.outlook.com (2603:1096:301:0:cafe::3a) by PSBPR02CA0013.outlook.office365.com (2603:1096:301::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Tue, 28 Jul 2026 07:27:28 +0000

from mta-80-125.sparkpostmail.com (94.26.3.115) by TY2PEPF0000AB88.mail.protection.outlook.com (10.167.253.11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 07:27:26 +0000

Received-Spf

None (protection.outlook.com: mta-80-125.sparkpostmail.com does not designate permitted sender hosts)

Message-Id

<[1785223645227.92788406591589c5-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@a2zprivcap.com]>

attachment-5

SHA256 febbd0c967bb0f7dbec933abd4fc047943b8e023981021288b5a84d1038d2ca5
MD5 e13809608bd28bfbce8db050b83e57d7
SHA1 40371299bf25aa632cbd17bc5e4a7b7129b4ebad
SHA512 26b1b0535e3facf0b3617d6bdf72034ca48a96d30e77a00057aa446a2181cb21fa3483e2f27c534a928ac85ab5410f5e2a1c87623cbe0cfd6fc5c4e07643641d
SSDEEP 384:PMNSlEJm1FZACYlv6DmUj1b5x2/+ErDXzrPK8rDRiJSJKxiKVBg+ErDXzrPK8rDD:PMIlIm1rTTbDO3K8rD2BI3K8rD2B4
TLSH
T103829DB98F630E418A1273C81E98F89E10E55CD798E3D4F97957634707CF268EBA1B09
MD5 SHA1 SHA512 SSDEEP TLSH

Password

M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

[email protected]

From

[email protected]

Date

Tue, 28 Jul 2026 06:49:40 +0000

Subject

mCaller left Aschmitz - 34s Preview vHC- July 27, 2026 +65720231

Content-Type

multipart/mixed; boundary="_003_17852213807216a34f691e3bd204aJFZGS42DN5WW25LONFRWC5DJN5_"

Received

from KUXPR04MB8962.apcprd04.prod.outlook.com (2603:1096:d10:4f::5) by KL1PR0401MB4211.apcprd04.prod.outlook.com with HTTPS; Tue, 28 Jul 2026 06:49:47 +0000

from SI1PR02CA0006.apcprd02.prod.outlook.com (2603:1096:4:1f7::11) by KUXPR04MB8962.apcprd04.prod.outlook.com (2603:1096:d10:4f::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Tue, 28 Jul 2026 06:49:44 +0000

from OSA0EPF000000C7.apcprd02.prod.outlook.com (2603:1096:4:1f7:cafe::4f) by SI1PR02CA0006.outlook.office365.com (2603:1096:4:1f7::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Tue, 28 Jul 2026 06:49:44 +0000

from mta-80-125.sparkpostmail.com (94.26.3.115) by OSA0EPF000000C7.mail.protection.outlook.com (10.167.240.53) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Tue, 28 Jul 2026 06:49:42 +0000

Received-Spf

None (protection.outlook.com: mta-80-125.sparkpostmail.com does not designate permitted sender hosts)

Message-Id

<[1785221380721.6a34f691e3bd204a-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@a2zprivcap.com]>

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

09e1ce79-3069-3aba-b463-22b50343337e.eml

Email Headers

Extracted URLs

attachment-3

Email Headers

PLAY_Voice-+65-360-3928135865.svg

PLAY_Voice-+65-360-9788480939.svg

attachment-4

Email Headers

PLAY_Voice-+65-360-2895206583.svg

PLAY_Voice-+65-360-6835153703.svg

attachment-5

Email Headers

PLAY_Voice-+65-360-6062651018.svg

PLAY_Voice-+65-360-8145634681.svg

attachment-6

email-html-2.txt

email-plain-1.txt

image001.png