General

  • Target
    message001 (16).eml
  • Size 812KB
  • Sample260909-2jm2aabl2v
  • SHA256 156b2b5c132e5fc14853d67e067362f725685dac3fb10b11bea272b5b90af023
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • message001 (16).eml
    .eml 812KB
  • Certificate Of Creditable Withholding Tax.rar
    .rar 596KB
  • Users/catoma/OneDrive/Desktop/Data Encoder/Certificate Of Creditable Withholding Tax.iso
    .iso 1.3MB
  • Certificate Of Creditable Withholding Tax.exe
    .exe 1.2MB
  • email-html-2.txt
    .html 2KB
  • email-plain-1.txt
    1KB

message001 (16).eml

  • SHA256 156b2b5c132e5fc14853d67e067362f725685dac3fb10b11bea272b5b90af023
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

<[email protected]>

Date

Mon, 7 Sep 2026 11:39:51 +0800

Subject

BIR Email Notification (Certificate Of Creditable Withholding Tax)

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0033_01DD3F6F.00DA9E30"

Received

from server.onemagellan.com by server.onemagellan.com with LMTP id I8vLA10ynmofkCMAUxK1SA (envelope-from <[email protected]>) for <[email protected]>; Mon, 07 Sep 2026 11:41:17 +0800

from server.mosbeau.com ([205.251.155.112]:53820) by server.onemagellan.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.99.5) (envelope-from <[email protected]>) id 1x3QE1-00000009mEE-2GTb for [email protected]; Mon, 07 Sep 2026 11:41:16 +0800

from [46.183.221.22] (port=53196 helo=ip-221-22.dataclub.info) by server.mosbeau.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.99.5) (envelope-from <[email protected]>) id 1x3QD4-000000006jV-27gt for [email protected]; Mon, 07 Sep 2026 03:40:09 +0000

X-Mailer

Microsoft Outlook 15.0

Message-Id

<[email protected]>