General

  • Target
    2026-TKLFTLP-35163.msg
  • Size 217KB
  • Sample260903-qeskeshd96
  • SHA256 6f1a3caaa7ad17449a191f96ad9f72e3211b12cef7f0ef99fe55cee2142c0b0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 2026-TKLFTLP-35163.msg
    .msg 217KB
  • Statement Of Work.docx
    .docx 111KB
  • image2dc0e5.JPG
    .jpg 11KB

2026-TKLFTLP-35163.msg

  • SHA256 6f1a3caaa7ad17449a191f96ad9f72e3211b12cef7f0ef99fe55cee2142c0b0a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 25 Aug 2026 06:05:36 +0000

Subject

2026-TKLFTLP-35163

Content-Type

multipart/mixed; boundary="_006_7b91677d75784a668f2045bbc3cb2bb0aselsancom_"

Received

from MR1PPF375D3D4D7.FRAP264.PROD.OUTLOOK.COM (2603:10a6:508:1::21c) by MR1P264MB2114.FRAP264.PROD.OUTLOOK.COM with HTTPS; Tue, 25 Aug 2026 06:31:07 +0000

from PR3P189CA0065.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:b4::10) by MR1PPF375D3D4D7.FRAP264.PROD.OUTLOOK.COM (2603:10a6:508:1::21c) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Tue, 25 Aug 2026 06:31:03 +0000

from PA3PEPF000089BA.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:b4:cafe::19) by PR3P189CA0065.outlook.office365.com (2603:10a6:102:b4::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.12 via Frontend Transport; Tue, 25 Aug 2026 06:31:03 +0000

from r-vga-rvega-3-x.dc.aviation (143.196.159.101) by PA3PEPF000089BA.mail.protection.outlook.com (10.167.242.22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Tue, 25 Aug 2026 06:31:02 +0000

from relais4.lfpo.aviation-civile.gouv.fr (unknown [172.16.249.220]) by r-vga-rvega-3-x.dc.aviation (Relais VEGA PROD (Postfix)) with ESMTPS id C2EFF2000D for <[email protected]>; Tue, 25 Aug 2026 08:31:01 +0200 (CEST)

from localhost (localhost [127.0.0.1]) by relais4.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTP id B7E3A2400F7 for <[email protected]>; Tue, 25 Aug 2026 08:31:01 +0200 (CEST)

from relais4.lfpo.aviation-civile.gouv.fr ([127.0.0.1]) by localhost (relais4.lfpo.aviation [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gqj-KSC4vKvv for <[email protected]>; Tue, 25 Aug 2026 08:30:59 +0200 (CEST)

from turunc.aselsan.com.tr (turunc.aselsan.com.tr [92.45.88.104]) by relais4.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTPS id 9E4A82400F6 for <[email protected]>; Tue, 25 Aug 2026 08:30:59 +0200 (CEST)

from turunc.aselsan.com.tr ([127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB83460267 for <[email protected]>; Tue, 25 Aug 2026 02:05:37 -0400 (EDT)

from turunc.aselsan.com.tr ([127.0.0.1]) by IMSVA (Postfix) with ESMTP id C5FA560266 for <[email protected]>; Tue, 25 Aug 2026 02:05:37 -0400 (EDT)

from turunc.aselsan.com.tr(turunc.aselsan.com.tr [127.0.0.1]) by turunc.aselsan.com.tr

from turunc.aselsan.com.tr ([10.1.204.3]) by isengard01.aselsan.com.tr (Service) with ESMTP id A8D744012B4D for <[email protected]>; Tue, 25 Aug 2026 09:05:36 +0300 (+03)

from turunc.aselsan.com.tr(turunc.aselsan.com.tr [127.0.0.1]) by turunc.aselsan.com.tr

from turunc.aselsan.com.tr(turunc.aselsan.com.tr [127.0.0.1]) by turunc.aselsan.com.tr

Received-Spf

Pass (protection.outlook.com: domain of aselsan.com designates 92.45.88.104 as permitted sender) receiver=protection.outlook.com; client-ip=92.45.88.104; helo=turunc.aselsan.com.tr; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://www.aselsan.com/tr