Overview

overview

6

Static

static

1

90fe3336-1...d5.eml

windows10-2004-x64

6

90fe3336-1...d5.eml

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    90fe3336-164e-d56e-e077-903c307de8d5.eml
  • Size 13KB
  • Sample260907-phex3awfpd
  • SHA256 ddc7ac1ea3cb3856b08c589ed170df23f50af9b42e0679ac63e05c9c6a5525f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 90fe3336-164e-d56e-e077-903c307de8d5.eml
    .eml 13KB
  • email-html-1.txt
    .html 2KB

90fe3336-164e-d56e-e077-903c307de8d5.eml

  • SHA256 ddc7ac1ea3cb3856b08c589ed170df23f50af9b42e0679ac63e05c9c6a5525f1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 7 Sep 2026 10:19:21 +0200 (CEST)

Subject

=?utf-8?Q?R=C3=A9g=C3=A9n=C3=A9rez_votre_mot_?= =?utf-8?Q?de_passe_ID=C2=A0ALL=C2=A0Site?=

Content-Type

multipart/mixed; boundary="----=_Part_24009_929099920.1788769161197"

Received

from PA7P264CA0018.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2df::9) by MR0P264MB8016.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:aa::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 08:30:35 +0000

from PA1PEPF000CC3FC.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2df:cafe::45) by PA7P264CA0018.outlook.office365.com (2603:10a6:102:2df::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Mon, 7 Sep 2026 08:30:35 +0000

from a-vga-rvega-3-x.dc.aviation (143.196.159.101) by PA1PEPF000CC3FC.mail.protection.outlook.com (10.167.242.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Mon, 7 Sep 2026 08:30:35 +0000

from relais3.lfpo.aviation-civile.gouv.fr (unknown [172.16.249.219]) by a-vga-rvega-3-x.dc.aviation (Relais VEGA PROD (Postfix)) with ESMTPS id 573202000D for <[email protected]>; Mon, 7 Sep 2026 10:30:35 +0200 (CEST)

from localhost (localhost [127.0.0.1]) by relais3.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTP id 508B5180005 for <[email protected]>; Mon, 7 Sep 2026 10:30:35 +0200 (CEST)

from relais3.lfpo.aviation-civile.gouv.fr ([127.0.0.1]) by localhost (relais3.lfpo.aviation [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IbtdfAfkaWNU for <[email protected]>; Mon, 7 Sep 2026 10:30:34 +0200 (CEST)

from o57.relay.tem.scaleway.com (o57.relay.tem.scaleway.com [62.210.3.41]) by relais3.lfpo.aviation-civile.gouv.fr (Postfix) with ESMTPS id D9337180004 for <[email protected]>; Mon, 7 Sep 2026 10:30:34 +0200 (CEST)

Received-Spf

Pass (protection.outlook.com: domain of idcapture.net designates 62.210.3.41 as permitted sender) receiver=protection.outlook.com; client-ip=62.210.3.41; helo=o57.relay.tem.scaleway.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://customer-service.idcapture.fr/fr

  • file https://idall-site.idcapture.fr/rui/home