DownloadedMessage (65).zip
- SHA256 688ee4be76839d7a2b23248a75b2f62d415871047e45f95abade4332f75ab339
Password
re
Overview
overview
3Static
static
3Downloaded...5).zip
windows10-2004-x64
1Downloaded...5).zip
windows11-ltsc_2024-x64
1Message.eml
windows10-2004-x64
1Message.eml
windows11-ltsc_2024-x64
1email-html-1.html
windows10-2004-x64
3email-html-1.html
windows11-ltsc_2024-x64
3invoice_Pr...04.pdf
windows10-2004-x64
3invoice_Pr...04.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
DownloadedMessage (65).zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
DownloadedMessage (65).zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Message.eml
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Message.eml
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
email-html-1.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
email-html-1.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
invoice_PriceChopper_963804.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target DownloadedMessage (65).zip
- Size 24KB
- Sample260928-pdgk4atamd
- SHA256 688ee4be76839d7a2b23248a75b2f62d415871047e45f95abade4332f75ab339
- MD5 b62ea56a1cf8251a88574c9d986951d1
- SHA1 03fe6af7405a68f0add3591b7981caf5191c32d3
- SHA512 be1e8fa861de64618a9271b4cf01f3300becdf44599137a044d7eca175346a3b075fbca665598e2b41a9353dba618e98e7b96d75ecec29ec90922d61d7ee0f72
- SSDEEP 768:MZ7F6u5fXcmLDK7WhCgb0mXUI4T6ZQRVuM5vcz6h:4730mLDsWkABXUFTfRUscz2
- TLSH T1ACB2F105FEC9DDA3C6AE7E961E013E374DB6F630259873E097A1A5F24DD0008C6A56F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
DownloadedMessage (65).zip.zip 24KB
-
Message.eml.eml 41KB
-
email-html-1.txt.html 8KB
-
invoice_PriceChopper_963804.pdf.pdf 16KB
Message.eml
- SHA256 68b6f00c0073f48c9bb6c5dacc604c72859ea44dc5110f2aa292ab14bc34c8e5
- MD5 0a2d8a9087b7ba31113f9380424e16e8
- SHA1 c1000209fcde778c65990f9f228506bea8aad841
- SHA512 e3ccf85525b0417f8793f3eebd2c8e38be86d5702b23c927c7e2b1d8e855d6eb4cb789ee3ae9e3329a43a32ce781d5703d2bf5e14bbd99614a6d1914f3030b18
- SSDEEP 768:uBgKUXN/XK8M9KdyUJl6h5o5xKt1zBfWvCo7B5HLJiBDrcKY51CIxlJo:9KUtesl6PoDYvfWqonL8BpY51CWa
- TLSH T1EE13901947015EA7CEB241B880029A58C366BA0DE57B02F0B467B77B1FCF0255B7FB99
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
re
Email Headers
From
Reply-To
Return-Path
010001a0e6ec7328-d21563dd-4fd2-46db-8b9f-3b68b625be48-000000@amazonses.com
Date
Mon, 28 Sep 2026 07:30:50 +0000
Subject
FINAL REMINDER - Your One Network Enterprises account is at risk of suspension
Content-Type
multipart/mixed; boundary="----=_Part_9438_609076585.1790580650556"
Received
from BN9PR03CA0418.namprd03.prod.outlook.com (2603:10b6:408:111::33) by PH0PR12MB5606.namprd12.prod.outlook.com (2603:10b6:510:141::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.23; Mon, 28 Sep 2026 07:30:51 +0000
from BL02EPF0002992E.namprd02.prod.outlook.com (2603:10b6:408:111:cafe::9f) by BN9PR03CA0418.outlook.office365.com (2603:10b6:408:111::33) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.24 via Frontend Transport; Mon, 28 Sep 2026 07:30:51 +0000
from a9-32.smtp-out.amazonses.com (54.240.9.32) by BL02EPF0002992E.mail.protection.outlook.com (10.167.249.59) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 28 Sep 2026 07:30:51 +0000
Received-Spf
Pass (protection.outlook.com: domain of amazonses.com designates 54.240.9.32 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.9.32; helo=a9-32.smtp-out.amazonses.com; pr=C
Message-Id
<010001a0e6ec7328-d21563dd-4fd2-46db-8b9f-3b68b625be48-000000@email.amazonses.com>
Extracted URLs
-
file http://tb9kxxdf.r.us-east-1.awstrack.me/L0/mailTo:[email protected]/1/010001a0e6ec7328-d21563dd-4fd2-46db-8b9f-3b68b625be48-000000/5-UEF2tytKrAOdIELEh1bA4HqYw=473
-
file https://tb9kxxdf.r.us-east-1.awstrack.me/L0/https:/onenetwork.blubilling.com/1/010001a0e6ec7328-d21563dd-4fd2-46db-8b9f-3b68b625be48-000000/yyKnx8FO7O8yGCgYp-Rog3TEVzY=473
-
file https://tb9kxxdf.r.us-east-1.awstrack.me/L0/https:/onenetwork.blubilling.com/2/010001a0e6ec7328-d21563dd-4fd2-46db-8b9f-3b68b625be48-000000/Zw5YpM_C1pYWxqRPuQYR67JtlpY=473
email-html-1.txt
- SHA256 4eebaabe9952d55fd4f3d12163122e9d3f4f424dad961aec8374c4774ccaf93d
- MD5 b9b30eefcc4e36c01c9244d185e200a0
- SHA1 46ff3bb73dc4dba4a6cdd619c4b8bb24d30cba94
- SHA512 89c7f60028b5dc4e4523f021213edf8a611a5cd745bd59973e429b3f21d8b4507b68863291b7fa43a7c7cb3da005a96f2ec850dd43ef12d4eae0cc6f4f08534b
- SSDEEP 192:IQanaPOooyiHKSYr6bYrowY60hfYBrQYXlWA7Rd8g2hh45D:IlnaPO+SYr6bYrowY60hfY1QilXRd8tQ
- TLSH T13202025293807F2F45BB90B8E022AAADC3CD9206571607F8F46722677F4A42156F77EC
- MD5 SHA1 SHA512 SSDEEP TLSH
invoice_PriceChopper_963804.pdf
- SHA256 506859e773296f874fb6aa7b1cbaa7176f81a711ee6617efedc20ddf20c7c33b
- MD5 337feaf838217a950d179be69a44bb94
- SHA1 ef64f9a8a3ab74e5029a19821e2a79dde04c5f76
- SHA512 1cbec8881744975305a4b32e8e91864c425eab23eead3db73c9b53139ac932db307131f4ebd0b9a69ec432213a86821a5f36886205a16296ce2555ab90feb5e4
- SSDEEP 384:4dXi+gFoPmoZq2CFT7/y1op7yTU+Nq4aFaGUHTDj3cL2b62Xs:4dXi+wo/Zq7T7/y1qZ+NqXaGePjsiXXs
- TLSH T1F672C009E1364D5DF8F298247D317AA2E36CF9EAC3FCE888133D469D91C165817A51F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
re
Extracted URLs
-
file http://pricechopper.com
-
file http://www.onenetwork.com/INVOICEINVOICE
-
file https://blueyonder.com/pay?inv=63669UGE96380496038&profileId=DEFAULT