Resubmissions

22/09/2026, 07:43

260922-jklkqsbb493

22/09/2026, 07:36

260922-jfeavs1dlg3

General

  • Target
    8b3bac69-a1e9-d21f-84de-91ab4ba316cb.eml
  • Size 296KB
  • Sample260922-jklkqsbb49
  • SHA256 20ba4bb7f612abd8cc88e80392253c28de0e327d74b0297986fe6116f628f10c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 8b3bac69-a1e9-d21f-84de-91ab4ba316cb.eml
    .eml 296KB
  • ATT63646926.pdf
    .pdf 196KB
  • email-html-1.txt
    .html 12KB

8b3bac69-a1e9-d21f-84de-91ab4ba316cb.eml

  • SHA256 20ba4bb7f612abd8cc88e80392253c28de0e327d74b0297986fe6116f628f10c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected

Email Headers

In-Reply-To

[email protected]

Return-Path

[email protected]

Date

Mon, 21 Sep 2026 13:06:27 +0000

Subject

Benefits & Reward Structure Assessment

Content-Type

multipart/mixed; boundary="===============1301205564526585379=="

Received

from DB9PR03MB9855.eurprd03.prod.outlook.com (2603:10a6:10:45e::9) by VE1PR03MB5872.eurprd03.prod.outlook.com with HTTPS; Mon, 21 Sep 2026 13:08:34 +0000

from GV3PEPF0001DC00.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:400::30a) by DB9PR03MB9855.eurprd03.prod.outlook.com (2603:10a6:10:45e::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.15; Mon, 21 Sep 2026 13:06:35 +0000

from CPH1EPF00000524.eurprd05.prod.outlook.com (2603:10a6:388::1e7) by GV3PEPF0001DC00.outlook.office365.com (2603:10a6:158:400::30a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Mon, 21 Sep 2026 13:06:32 +0000

from PNYPR01CU001.outbound.protection.outlook.com (2a01:111:f403:c408::1) by CPH1EPF00000524.mail.protection.outlook.com (2603:10a6:388::1e7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Mon, 21 Sep 2026 13:06:31 +0000

from MA0PR01CA0051.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:ac::9) by MA5P287MB6013.INDP287.PROD.OUTLOOK.COM (2603:1096:a01:231::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Mon, 21 Sep 2026 13:06:29 +0000

from MA1PEPF000072B1.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:ac:cafe::2) by MA0PR01CA0051.outlook.office365.com (2603:1096:a01:ac::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Mon, 21 Sep 2026 13:06:29 +0000

from [45.83.245.242] (45.83.245.242) by MA1PEPF000072B1.mail.protection.outlook.com (10.167.242.21) with Microsoft SMTP Server id 15.21.451.8 via Frontend Transport; Mon, 21 Sep 2026 13:06:27 +0000

Received-Spf

Pass (protection.outlook.com: domain of lohiyaagro.com designates 2a01:111:f403:c408::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c408::1; helo=PNYPR01CU001.outbound.protection.outlook.com; pr=C

Fail (protection.outlook.com: domain of lohiyaagro.com does not designate 45.83.245.242 as permitted sender) receiver=protection.outlook.com; client-ip=45.83.245.242; helo=[45.83.245.242];

X-Mailer

Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)

User-Agent

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification