Overview

overview

4

Static

static

1

file_63925...57.msg

windows10-2004-x64

4

file_63925...57.msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    file_639259415512667657.msg
  • Size 117KB
  • Sample260925-qbf28aec94
  • SHA256 525d2d5e20fbee44702449fbf5d04a62e4a2c400e8c2eb8b479ce56664a2c146
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • file_639259415512667657.msg
    .msg 117KB

file_639259415512667657.msg

  • SHA256 525d2d5e20fbee44702449fbf5d04a62e4a2c400e8c2eb8b479ce56664a2c146
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

25 Sep 2026 05:40:32 -0700

Subject

=?UTF-8?B?8J+UkiBNYWlsYm94IEFjY2VzcyBhdCBSaXNrfCBBQ1RJT04gUkVRVUlSRUQhISE=?=

Content-Type

text/html

Received

from LO0P123MB7922.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:42b::18) by LO4P123MB5303.GBRP123.PROD.OUTLOOK.COM with HTTPS; Fri, 25 Sep 2026 12:42:31 +0000

from CW1P265CA0016.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:29f::7) by LO0P123MB7922.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:42b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Fri, 25 Sep 2026 12:40:37 +0000

from CW2PEPF000056BC.GBRP265.PROD.OUTLOOK.COM (2603:10a6:400:29f:cafe::80) by CW1P265CA0016.outlook.office365.com (2603:10a6:400:29f::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Fri, 25 Sep 2026 12:40:37 +0000

from delivery-prod-eun1-az.emailsecurity.app (52.236.20.17) by CW2PEPF000056BC.mail.protection.outlook.com (10.167.240.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Fri, 25 Sep 2026 12:40:37 +0000

from [169.254.129.3] ([10.1.4.227]) by delivery-prod-eun1-az.emailsecurity.app (Haraka/3.1.1) with ESMTP id 3BE5DC47-0F54-4A92-8B82-20D4F0057B20.1 envelope-from <[email protected]>; Fri, 25 Sep 2026 12:40:37 +0000

from mail-ot1-f101.google.com (mail-ot1-f101.google.com [209.85.210.101]) by mx1-eu.emailsecurity.app (Haraka/3.1.1) with ESMTPS id 2DA845D1-722F-4C1C-86AE-6A564DC6585E.1 envelope-from <[email protected]> tls TLS_AES_256_GCM_SHA384; Fri, 25 Sep 2026 12:40:36 +0000

by mail-ot1-f101.google.com with SMTP id 46e09a7af769-7f69672e369so200623a34.0 for <[email protected]>; Fri, 25 Sep 2026 05:40:35 -0700 (PDT)

from intime.cz ([107.149.8.113]) by smtp-relay.gmail.com with ESMTP id 46e09a7af769-818e60221eesm797002a34.2.2026.09.25.05.40.34 for <[email protected]>; Fri, 25 Sep 2026 05:40:34 -0700 (PDT)

X-Received

by 2002:a05:6830:61c4:b0:806:6e79:c7ea with SMTP id 46e09a7af769-81780d9a85fmr5581439a34.6.1790340034880; Fri, 25 Sep 2026 05:40:34 -0700 (PDT)

Received-Spf

None (protection.outlook.com: intime.cz does not designate permitted sender hosts)

none (mx1-eu.emailsecurity.app: intime.cz does not designate permitted sender hosts) client-ip=209.85.210.101;

Message-Id

<[email protected]>

Extracted URLs

  • file http://msfltd.co.uk

  • file https://trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYmVhdHRoZW9kZHMubWFya2V0aW5nbGFjb2NvYTMud29ya2Vycy5kZXYvMzE4M2JmNGRlOGRlNDBlNyIsImVtYWlsSWQiOiI2NWQxNDg2Ny0wMTg3LTRlOTQtOWY0Yi05ZmFjYzM2ZjVhYTciLCJpYXQiOjE3ODgyNjA2NjJ9.RRd3LKHaORt2gyHXXzffUR_vYN-7L9x_8j4mgWbffVE&

  • file https://www.google.com/url?q=https%3A%2F%2Ftrackingservice.monday.com%2Ftracker%2Flink%3Ftoken%3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vYmVhdHRoZW9kZHMubWFya2V0aW5nbGFjb2NvYTMud29ya2Vycy5kZXYvMzE4M2JmNGRlOGRlNDBlNyIsImVtYWlsSWQiOiI2NWQxNDg2Ny0wMTg3LTRlOTQtOWY0Yi05ZmFjYzM2ZjVhYTciLCJpYXQiOjE3ODgyNjA2NjJ9.RRd3LKHaORt2gyHXXzffUR_vYN-7L9x_8j4mgWbffVE%26&sa=D&sntz=1&usg=AOvVaw3QYc3WEY8waAiZOc3G4LtD#[[convert_to_base64(-Email-,TRUE)]]