Overview

overview

1

Static

static

1

attachment (60).eml

windows10-2004-x64

1

attachment (60).eml

windows11-ltsc_2024-x64

1

SMARTER_Gr...t.docx

windows10-2004-x64

1

SMARTER_Gr...t.docx

windows11-ltsc_2024-x64

1

Resubmissions

09/08/2026, 10:43

260809-mr94fszsev1

09/08/2026, 10:33

260809-mln9sswdla1

Sharing

Copy URL Twitter E-mail

General

  • Target
    attachment (60).eml
  • Size 81KB
  • Sample260809-mln9sswdla
  • SHA256 5d606065d3ed64d11a44fe5e2e68a4ade147e9e29a3239366c1c63a8e115ead1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • attachment (60).eml
    .eml 81KB
  • SMARTER_Green Mortgage Underwriting Course_Lawsuit.docx
    .docx 31KB
  • email-html-2.txt
    .html 8KB
  • email-plain-1.txt
    2KB

attachment (60).eml

  • SHA256 5d606065d3ed64d11a44fe5e2e68a4ade147e9e29a3239366c1c63a8e115ead1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Sat, 8 Aug 2026 18:31:44 +0000

Subject

=?utf-8?B?QnJlYWNoIG9mIENvbnRyYWN0IExhd3N1aXQuLi4gR3JhdGVmdWwgVG8gQmUg?= =?utf-8?B?SW4gVWtyYWluZS4uLvCfmY/wn4e68J+Hpg==?=

Content-Type

multipart/mixed; boundary="_004_5321432F47EF4BF3978112695A1AD31Ecapturiantcom_"

Received

from AM8PR05MB7233.eurprd05.prod.outlook.com (2603:10a6:20b:1c5::17) by VI1PR05MB10935.eurprd05.prod.outlook.com with HTTPS; Sat, 8 Aug 2026 18:32:19 +0000

from YQZPR01CA0132.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:87::16) by AM8PR05MB7233.eurprd05.prod.outlook.com (2603:10a6:20b:1c5::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Sat, 8 Aug 2026 18:32:17 +0000

from YQYPR01MB11454.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:87:cafe::a5) by YQZPR01CA0132.outlook.office365.com (2603:10b6:c01:87::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25 via Frontend Transport; Sat, 8 Aug 2026 18:32:16 +0000

from YT4PR01CA0131.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d5::28) by YQYPR01MB11454.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:ac::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Sat, 8 Aug 2026 18:31:55 +0000

from YT1PEPF00001E8C.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d5:cafe::6) by YT4PR01CA0131.outlook.office365.com (2603:10b6:b01:d5::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.25 via Frontend Transport; Sat, 8 Aug 2026 18:31:55 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (195.130.217.221) by YT1PEPF00001E8C.mail.protection.outlook.com (10.167.241.53) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.315.6 via Frontend Transport; Sat, 8 Aug 2026 18:31:55 +0000

from DM1PR04CU001.outbound.protection.outlook.com (mail-centralusazon11020114.outbound.protection.outlook.com [52.101.61.114]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-266-iYdbq_snPuez87rxW_2QYA-2; Sat, 08 Aug 2026 19:31:49 +0100

from SA0PR15MB4047.namprd15.prod.outlook.com (2603:10b6:806:91::18) by SJ0PR15MB4584.namprd15.prod.outlook.com (2603:10b6:a03:37a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Sat, 8 Aug 2026 18:31:45 +0000

from SA0PR15MB4047.namprd15.prod.outlook.com ([fe80::9a85:db50:6fb8:f24e]) by SA0PR15MB4047.namprd15.prod.outlook.com ([fe80::9a85:db50:6fb8:f24e%6]) with mapi id 15.21.0245.010; Sat, 8 Aug 2026 18:31:44 +0000

Received-Spf

Fail (protection.outlook.com: domain of capturiant.com does not designate 195.130.217.221 as permitted sender) receiver=protection.outlook.com; client-ip=195.130.217.221; helo=eu-smtp-inbound-delivery-1.mimecast.com;

Message-Id

<[email protected]>

Extracted URLs

  • file https://url.uk.m.mimecastprotect.com/s/8BeiCoQR5Fg5gzRfzhq8hpitxN?domain=smarterfinance4.eu

  • file https://url.uk.m.mimecastprotect.com/s/8BeiCoQR5Fg5gzRfzhq8hpitxN?domain=smarterfinance4.eu/

  • file https://url.uk.m.mimecastprotect.com/s/d_AxCnrQ3TPgPo2U9fQqhJnDOT?domain=calendly.com

  • file https://url.uk.m.mimecastprotect.com/s/eajFCqYR3UEnE53tEsKphERjfc?domain=climate64.com

  • file https://url.uk.m.mimecastprotect.com/s/h3ytCpQw3FVqV8WUYi2NhGS9FE?domain=climate64.com