General

  • Target
    dobW4q1fdmqY7Nq5B7RxMNxblnkSfxQ9_2026-09-16T07_41_59.528Z.eml
  • Size 6.9MB
  • Sample260916-jwf5dsvxbs
  • SHA256 ab64c4c6e098c008098f5d1ecef41535bd077bfb49ce9ade26665149aba7fe81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • dobW4q1fdmqY7Nq5B7RxMNxblnkSfxQ9_2026-09-16T07_41_59.528Z.eml
    .eml 6.9MB
  • Boiler Report - 2026.xlsx
    .xlsx 265KB
  • Compressor Running hours.xlsx
    .xlsx 11KB
  • DCS Mirror.xlsx
    .xlsx 86KB
  • FL-2 C.T BLOWDOWN DETAILS.xlsx
    .xlsx 14KB
  • Fl-5 WTP - 2026.xlsx
    .xlsx 171KB
  • HFO&Diesel - 2026.xlsx
    .xlsx 708KB
  • IUCS DCS report - 2025.xlsx
    .xlsx 407KB
  • PM SCHEDULE.xlsx
    .xlsx 55KB
  • RWH-1 STORAGE LEVEL REPORT - 2026.xls
    .xls 543KB
  • Sipcot & TTRO.xlsx
    .xlsx 93KB
  • Water consumption Sep-26 new.xlsx
    .xlsx 810KB
  • WhatsApp - 2026.xlsx
    .xlsx 1.9MB
  • email-html-2.txt
    9KB
  • email-plain-1.txt
    128B

dobW4q1fdmqY7Nq5B7RxMNxblnkSfxQ9_2026-09-16T07_41_59.528Z.eml

  • SHA256 ab64c4c6e098c008098f5d1ecef41535bd077bfb49ce9ade26665149aba7fe81
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

AMDPR01MB11746FC51A52150667AE0768892BA2@AMDPR01MB11746.eurprd01.prod.exchangelabs.com

Return-Path

[email protected]

Date

Wed, 16 Sep 2026 02:22:56 +0000

Subject

FLOAT 1,2 & 5 water report.

Content-Type

multipart/mixed; boundary="_015_GV2PR01MB11731EF5FE4F1E46E4EA9807692B92GV2PR01MB11731eu_"

Received

from PA4PR02MB6767.eurprd02.prod.outlook.com (::1) by AM9PR02MB6994.eurprd02.prod.outlook.com with HTTPS; Wed, 16 Sep 2026 02:28:01 +0000

from WA1PEPF00005B96.POLP291.PROD.OUTLOOK.COM (2603:10a6:1d8::633) by PA4PR02MB6767.eurprd02.prod.outlook.com (2603:10a6:102:fc::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.11; Wed, 16 Sep 2026 02:27:03 +0000

from WA1PEPF000099D1.eurprd04.prod.outlook.com (2603:10a6:1d8::169) by WA1PEPF00005B96.outlook.office365.com (2603:10a6:1d8::633) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Wed, 16 Sep 2026 02:27:03 +0000

from mx07-00009201.pphosted.com (185.132.180.224) by WA1PEPF000099D1.mail.protection.outlook.com (10.167.242.25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 02:27:02 +0000

from pps.filterd (m0447335.ppops.net [127.0.0.1]) by mx08-00009201.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68FM27i9638618 for <[email protected]>; Wed, 16 Sep 2026 02:27:02 GMT

from mx07-002c9e02.pphosted.com (mx07-002c9e02.pphosted.com [205.220.184.235]) by mx08-00009201.pphosted.com (PPS) with ESMTPS id 4gqeewh32k-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Wed, 16 Sep 2026 02:23:23 +0000 (GMT)

from pps.filterd (m0321205.ppops.net [127.0.0.1]) by mx07-002c9e02.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68G1KpLn610365 for <[email protected]>; Wed, 16 Sep 2026 04:23:22 +0200

Received-Spf

Pass (protection.outlook.com: domain of ext.saint-gobain.com designates 205.220.184.235 as permitted sender) receiver=protection.outlook.com; client-ip=205.220.184.235; helo=mx07-002c9e02.pphosted.com; pr=C

Message-Id

<GV2PR01MB11731EF5FE4F1E46E4EA9807692B92@GV2PR01MB11731.eurprd01.prod.exchangelabs.com>