4afd2f3f-bc4f-0662-2605-ab4622b61e5b[.]eml

Sharing

Copy URL Twitter E-mail

General

Target
4afd2f3f-bc4f-0662-2605-ab4622b61e5b.eml
Size 843KB
Sample260928-nhhhhssdnf
SHA256 eb8dc83b227900a9a659426a8181307b213a9992a849072f41bff53228ac9c20
MD5 59c3607f07b6574ba7e4fc7b84b6db01
SHA1 274287a1a5a4a5172400eb6afe85c5f65ed2e8e7
SHA512 9a6b2d7389c237ea26dfb788153bcb7e0c1a789f9666ec6aaf441943737dbd32e9b6db756f006a1d29d86606643583066cc0adbcbcfb49848db0df17e9c3a301
SSDEEP 12288:uk6oCje5MmD1TszcNSbU3+JoIdFAsxZ1uSyONbDkBgTV8MLdBojwsFqLB52r7i/h:coQ8sAq80uSH5egdCqB6iUa
TLSH
T1E205E13CEC011ACA337112F6621EE6422F564B9F9105C893F1A9E26C7CDA565AF8127F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

File Explorer

4afd2f3f-bc4f-0662-2605-ab4622b61e5b.eml

.eml 843KB
Black Sea Maritime Security Update 27.pdf

.pdf 452KB
email-html-2.txt

.html 74KB
email-plain-1.txt

4KB
image001.png

.png 10KB
image002.png

.png 4KB
image003.jpg

.jpg 1013B
image004.png

.png 8KB
image005.jpg

.jpg 47KB

4afd2f3f-bc4f-0662-2605-ab4622b61e5b.eml

SHA256 eb8dc83b227900a9a659426a8181307b213a9992a849072f41bff53228ac9c20
MD5 59c3607f07b6574ba7e4fc7b84b6db01
SHA1 274287a1a5a4a5172400eb6afe85c5f65ed2e8e7
SHA512 9a6b2d7389c237ea26dfb788153bcb7e0c1a789f9666ec6aaf441943737dbd32e9b6db756f006a1d29d86606643583066cc0adbcbcfb49848db0df17e9c3a301
SSDEEP 12288:uk6oCje5MmD1TszcNSbU3+JoIdFAsxZ1uSyONbDkBgTV8MLdBojwsFqLB52r7i/h:coQ8sAq80uSH5egdCqB6iUa
TLSH
T1E205E13CEC011ACA337112F6621EE6422F564B9F9105C893F1A9E26C7CDA565AF8127F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

V4^2_u}$26MU_Z7#a{"f

Email Headers

[email protected]

From

[email protected]

In-Reply-To

SJ2PR12MB7990C6EE278BB6930F6B79F9CBFD2@SJ2PR12MB7990.namprd12.prod.outlook.com

Return-Path

[email protected]

Date

Mon, 28 Sep 2026 09:04:36 +0000

Subject

FW: CWD OSINT REPORT

Content-Type

multipart/mixed; boundary="_010_LOBP123MB85888B2F6B1B063DEA5C43889C8D2LOBP123MB8588GBRP_"

Received

from SEZPR04MB6552.apcprd04.prod.outlook.com (::1) by SEYPR04MB8631.apcprd04.prod.outlook.com with HTTPS; Mon, 28 Sep 2026 09:08:17 +0000

from SG2PR02CA0134.apcprd02.prod.outlook.com (2603:1096:4:188::14) by SEZPR04MB6552.apcprd04.prod.outlook.com (2603:1096:101:aa::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.23; Mon, 28 Sep 2026 09:06:12 +0000

from OSA0EPF000000C9.apcprd02.prod.outlook.com (2603:1096:4:188:cafe::1a) by SG2PR02CA0134.outlook.office365.com (2603:1096:4:188::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.23 via Frontend Transport; Mon, 28 Sep 2026 09:06:11 +0000

from esa1.hc847-16.ap.iphmx.com (139.138.45.217) by OSA0EPF000000C9.mail.protection.outlook.com (10.167.240.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 28 Sep 2026 09:06:10 +0000

from eu-smtp-delivery-153.mimecast.com ([185.58.86.153]) by esa1.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Sep 2026 17:06:04 +0800

from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11020077.outbound.protection.outlook.com [52.101.196.77]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-85-AnYoMVLQMBKrrkmZ32dr5A-1; Mon, 28 Sep 2026 10:04:57 +0100

from LO6P123CA0003.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:338::8) by LO2P123MB5959.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:257::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.21; Mon, 28 Sep 2026 09:04:46 +0000

from LO1PEPF0000605B.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:338:cafe::40) by LO6P123CA0003.outlook.office365.com (2603:10a6:600:338::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.24 via Frontend Transport; Mon, 28 Sep 2026 09:04:46 +0000

from uk2.smtp.exclaimer.net (51.141.5.228) by LO1PEPF0000605B.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 28 Sep 2026 09:04:43 +0000

from LO3P265CU004.outbound.protection.outlook.com (40.93.67.19) by uk2.smtp.exclaimer.net (51.141.5.228) with Exclaimer Signature Manager ESMTP Proxy uk2.smtp.exclaimer.net (tlsversion=TLS12, tlscipher=TLS_DIFFIEHELLMAN_WITH_AES256_NONE); Mon, 28 Sep 2026 09:04:46 +0000

from LOBP123MB8588.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:48c::18) by LO8P123MB7704.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:3d7::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.23; Mon, 28 Sep 2026 09:04:36 +0000

from LOBP123MB8588.GBRP123.PROD.OUTLOOK.COM ([fe80::9d3:59d7:d8f6:cb1e]) by LOBP123MB8588.GBRP123.PROD.OUTLOOK.COM ([fe80::9d3:59d7:d8f6:cb1e%5]) with mapi id 15.21.0451.022; Mon, 28 Sep 2026 09:04:36 +0000

Received-Spf

Fail (protection.outlook.com: domain of tysers.com does not designate 139.138.45.217 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.45.217; helo=esa1.hc847-16.ap.iphmx.com;

Pass (esa1.hc847-16.ap.iphmx.com: domain of [email protected] designates 185.58.86.153 as permitted sender) identity=mailfrom; client-ip=185.58.86.153; receiver=esa1.hc847-16.ap.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:195.130.217.0/24 ip4:91.220.42.0/24 ip4:146.101.78.0/24 ip4:207.82.80.0/24 ip4:213.167.81.0/25 ip4:193.7.207.0/25 ip4:213.167.75.0/25 ip4:185.58.85.0/24 ip4:185.58.86.0/24 ip4:193.7.206.0/25 ip4:147.28.36.0/24 ip4:193.7.204.0/24 ip4:193.7.205.0/24 ip4:185.58.84.0/24 ip4:185.58.87.0/24 ~all"

Message-Id

<LOBP123MB85888B2F6B1B063DEA5C43889C8D2@LOBP123MB8588.GBRP123.PROD.OUTLOOK.COM>

Extracted URLs

file https://protect-eu.mimecast.com/s/TuUqCmQ91ipVn88TGhWgX/
file https://protect-eu.mimecast.com/s/_QnRCnr92uX4oggHJVu7_/
file https://url.uk.m.mimecastprotect.com/s/4oBSCVPVwFN3DGAIGf4fEMjxh
file https://url.uk.m.mimecastprotect.com/s/4oBSCVPVwFN3DGAIGf4fEMjxh/
file https://url.uk.m.mimecastprotect.com/s/pkC5CXo9yuV2xwYSDikfW8JtF/
file https://www.google.com/maps/place/Link+House,+25+West+St,+Poole/@50.7157078,-1.9879549,98m/data=!3m1!1e3!4m5!3m4!1s0x4873a6efa043a52f:0x173b9c8859c6925!8m2!3d50.7157622!4d-1.9877849

Black Sea Maritime Security Update 27.pdf

SHA256 05f298cb5023da8e97d18f9f896950d78acaaffbebe02d85e359f49aee86b8e4
MD5 8baa0dc6ee1276d3bf56e331c404d28b
SHA1 1962982abee3578144d71ece1bb6a9a7c049ec22
SHA512 e29375d7622f377d500164aa244d0b2fe2994fc2faa85dc58fe9b5a96821855125809f4638dd28b6b19b93a769b1b04553f8716fc68a041f5a88eff7d0b67919
SSDEEP 6144:V+dQ7rnSIDSgmFFFFFFFFFFFFkmBFj+Pux5qnGaH/N+T/gHKKXfII69M4:rBdmhanGtDiV/4
TLSH
T158A4F153B6456DE8F8E182B867FF5059E16F7076D9FD888278E806502293D8A7FC2F40
MD5 SHA1 SHA512 SSDEEP TLSH

Password

V4^2_u}$26MU_Z7#a{"f

Extracted URLs

file https://censor.net/en/photonews/4011916/russia-attacked-odesa-with-drones-a-man-was-injured-and-buildings-were-damaged
file https://edition.cnn.com/2026/07/09/business/russia-diesel-ban-ukrainian-strikes-intl
file https://kyivindependent.com/st-petersburg-oil-terminal-july-4/
file https://kyivindependent.com/ukrainian-drones-reportedly-strike-oil-depots-in-multiple-russian-regions/
file https://oboronka.mezha.ua/en/sbs-urazili-dev-yat-tankeriv-tinovogo-flotu-rf-313028/
file https://united24media.com/war-in-ukraine/russian-ballistic-missile-strike-on-odesa-industrial-facility-leaves-six-injured-20551
file https://united24media.com/war-in-ukraine/ukraine-has-struck-at-least-six-major-russian-missile-production-plants-since-march-20604
file https://www.bbc.com/news/articles/ce8klree690o
file https://www.cnbc.com/2026/07/07/ukraine-russia-omsk-oil-refinery-putin-nato.html
file https://www.globalbankingandfinance.com/russian-attack-kills-four-ukraine-port-odesa-official/
file https://www.internazionale.it/ultime-notizie-reuters/2026/07/09/exclusive-putin-likely-to-escalate-ukraine-war-despite-trump-peace-push-sources-say
file https://www.japantimes.co.jp/news/2026/07/09/world/russia-musk-starlink-ukraine-drones/
file https://www.marinelink.com/news/chevron-oil-tanker-hit-drone-541047
file https://www.pravda.com.ua/eng/news/2026/07/08/8043083/
file https://www.seatrade-maritime.com/security/ukraine-claims-14-more-drone-strikes-on-russian-ships
file https://www.seatrade-maritime.com/security/ukraine-hits-21-russian-ships-within-72-hours
file https://www.seatrade-maritime.com/security/ukraine-hits-21-russian-ships-within-72-hours%20https:/www.pravda.com.ua/eng/news/2026/07/07/8042787/
file https://www.themoscowtimes.com/2026/07/08/at-least-2-killed-in-russia-as-ukraine-hits-multiple-oil-refineries-a93193
file https://www.themoscowtimes.com/2026/07/10/russia-says-it-will-widen-buffer-zone-in-response-to-ukrainian-strikes-a93217
file https://www.themoscowtimes.com/2026/07/10/ukraine-strikes-oil-refinery-in-southern-russia-a93215
Show all

Sharing

General

Malware Config

Signatures

File Explorer

4afd2f3f-bc4f-0662-2605-ab4622b61e5b.eml

Email Headers

Extracted URLs

Black Sea Maritime Security Update 27.pdf

Extracted URLs

email-html-2.txt

email-plain-1.txt

image001.png

image002.png

image003.jpg

image004.png

image005.jpg