Overview

overview

6

Static

static

5

Play_VM_01...pm.svg

windows11-ltsc_2024-x64

6

Resubmissions

07/09/2026, 14:39

260907-r1hg1syelg5

07/09/2026, 14:36

260907-ryx5paxset6

07/09/2026, 14:24

260907-rq7zxsbl9y8

07/09/2026, 14:18

260907-rmetzabl5v7

07/09/2026, 14:14

260907-rjygxawzaz7

Sharing

Copy URL Twitter E-mail

General

  • Target
    vzpPL0kagUpRUt323i7jgHHK9xvI0W5M_2026-09-07T13_57_48.603Z.eml
  • Size 29KB
  • Sample260907-ryx5paxset
  • SHA256 fc703a3e20c9bad506d3282d92c9a14a239292bd5ff956b575eab9636484cb09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
svgjavascript

Malware Config

Signatures

  • Suspicious SVG script tag 1 IoCs
    svgjavascript
  • SVG contains script element(s) 1 IoCs
    svgjavascript

File Explorer

  • vzpPL0kagUpRUt323i7jgHHK9xvI0W5M_2026-09-07T13_57_48.603Z.eml
    .eml 29KB
  • attachment-3
    .eml 4KB
  • Play_VM_01mins42sec_3pm.svg
    .svg .xml 458B
  • email-html-1.txt
    .html 1KB
  • email-html-2.txt
    5KB
  • email-plain-1.txt
    650B

vzpPL0kagUpRUt323i7jgHHK9xvI0W5M_2026-09-07T13_57_48.603Z.eml

  • SHA256 fc703a3e20c9bad506d3282d92c9a14a239292bd5ff956b575eab9636484cb09
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

Microsoft Outlook <[email protected]>

Return-Path

<>

Date

Fri, 4 Sep 2026 14:53:22 +0000

Subject

(External) VmCaller left dabney.bradley Vm Msg 0:53:01sec Ref#: ea5zby 9/4/2026

Content-Type

multipart/mixed; boundary="_48d9f095-44b0-4e55-b700-a1a4fdb35e5f_"

Received

from GV2PR02MB12094.eurprd02.prod.outlook.com (2603:10a6:150:329::10) by DU5PR02MB10872.eurprd02.prod.outlook.com with HTTPS; Fri, 4 Sep 2026 15:10:35 +0000

from VIUP296CA0139.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34a::12) by GV2PR02MB12094.eurprd02.prod.outlook.com (2603:10a6:150:329::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Fri, 4 Sep 2026 15:09:38 +0000

from ZR1PEPF0000E45F.eurprd04.prod.outlook.com (2603:10a6:800:34a:cafe::45) by VIUP296CA0139.outlook.office365.com (2603:10a6:800:34a::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.13 via Frontend Transport; Fri, 4 Sep 2026 15:09:38 +0000

from mx08-00009201.pphosted.com (185.183.28.182) by ZR1PEPF0000E45F.mail.protection.outlook.com (10.167.241.55) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Fri, 4 Sep 2026 15:09:38 +0000

from pps.filterd (m0168935.ppops.net [127.0.0.1]) by mx08-00009201.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 684EvOPI3732473 for <[email protected]>; Fri, 4 Sep 2026 15:09:37 GMT

from sa9pr02cu001.outbound.protection.outlook.com (mail-southcentralusazhn15013039.outbound.protection.outlook.com [52.102.140.39]) by mx08-00009201.pphosted.com (PPS) with ESMTPS id 4gfw0e9tu8-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 04 Sep 2026 14:53:26 +0000 (GMT)

from SmtpServer.Submit by DS7PR11MB6102 with Microsoft SMTP Server id 15.21.360.13; Fri, 4 Sep 2026 14:53:22 +0000

Received-Spf

Pass (protection.outlook.com: domain of sa9pr02cu001.outbound.protection.outlook.com designates 52.102.140.39 as permitted sender) receiver=protection.outlook.com; client-ip=52.102.140.39; helo=sa9pr02cu001.outbound.protection.outlook.com; pr=C

Message-Id

<080fdd8a-f4de-473b-a32c-486729088db6@IncidentReport>