General

  • Target
    Re_ QingDao-PE_CO_MX available S_O space.eml
  • Size 158KB
  • Sample260817-2bae8aea67
  • SHA256 226173bb1f882f251e2a8ce5bae9cbbda4565f29d20152c03e9ef1531f18e3b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Re_ QingDao-PE_CO_MX available S_O space.eml
    .eml 158KB
  • 128521.png
    3KB
  • InsertPic_3C08(08-13-17-05-19).png
    .png 867B
  • InsertPic_6F2F(08-13-17-05-19).jpg
    .jpg 97KB
  • email-html-2.txt
    .html 5KB
  • email-plain-1.txt
    1KB

Re_ QingDao-PE_CO_MX available S_O space.eml

  • SHA256 226173bb1f882f251e2a8ce5bae9cbbda4565f29d20152c03e9ef1531f18e3b4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Fri, 14 Aug 2026 05:34:20 +0000

Subject

Re: QingDao-PE/CO/MX available S/O space

Content-Type

multipart/related; boundary="_006_20260813170553522534370amigossupplycom_"; type="multipart/alternative"

Received

from MW4PR04MB7171.namprd04.prod.outlook.com (2603:10b6:303:64::14) by DS4PR04MB9722.namprd04.prod.outlook.com with HTTPS; Fri, 14 Aug 2026 05:36:10 +0000

from MN0P220CA0004.NAMP220.PROD.OUTLOOK.COM (2603:10b6:208:52e::15) by MW4PR04MB7171.namprd04.prod.outlook.com (2603:10b6:303:64::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.16; Fri, 14 Aug 2026 05:34:54 +0000

from BL6PEPF0001AB55.namprd02.prod.outlook.com (2603:10b6:208:52e:cafe::a0) by MN0P220CA0004.outlook.office365.com (2603:10b6:208:52e::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.315.15 via Frontend Transport; Fri, 14 Aug 2026 05:34:54 +0000

from mail-m16023653204.xmail.ntesmail.com (160.236.53.204) by BL6PEPF0001AB55.mail.protection.outlook.com (10.167.241.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.3 via Frontend Transport; Fri, 14 Aug 2026 05:34:52 +0000

from DESKTOP-L57NTJG (unknown [14.153.29.38]) by smtp.qiye.163.com (Hmail) with ESMTP id 49f807d10 for <[email protected]>; Fri, 14 Aug 2026 13:34:49 +0800 (GMT+08:00)

Received-Spf

Pass (protection.outlook.com: domain of amigos-supply.com designates 160.236.53.204 as permitted sender) receiver=protection.outlook.com; client-ip=160.236.53.204; helo=mail-m16023653204.xmail.ntesmail.com; pr=C

X-Mailer

Foxmail 7.2.25.563[cn]

Message-Id

<[email protected]>

Extracted URLs

  • file https://nam02.safelinks.protection.outlook.com/?url=

  • file https://wa.me/8619968720141