Static

static

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Expiry Alert PHONE.msg
  • Size 54KB
  • Sample260929-sd5jpssfla
  • SHA256 dcc384593811333f0e376c47442903de5bc3ed728ec7e8b2e1c6c5f4028301d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Expiry Alert PHONE.msg
    .msg 54KB

Expiry Alert PHONE.msg

  • SHA256 dcc384593811333f0e376c47442903de5bc3ed728ec7e8b2e1c6c5f4028301d3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

<>

Date

Fri, 17 Jul 2026 10:31:21 +0000

Subject

Expiry Alert: [PHONE]

Content-Type

multipart/alternative; boundary="_=_swift_1784284281_18c33e86a829480bfef309ad401360fd_=_"

Received

from ISNSP-EXCMBX02.domain.is.net.tr (10.3.63.12) by ISNSP-EXCMBX01.domain.is.net.tr (10.3.63.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41 via Mailbox Transport; Fri, 17 Jul 2026 13:32:02 +0300

from ISNSP-EXCMBX01.domain.is.net.tr (10.3.63.11) by ISNSP-EXCMBX02.domain.is.net.tr (10.3.63.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Fri, 17 Jul 2026 13:32:02 +0300

from ISNETGVSND.localdomain (10.3.6.200) by ISNSP-EXCMBX01.domain.is.net.tr (10.3.63.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41 via Frontend Transport; Fri, 17 Jul 2026 13:32:02 +0300

from ISNETGVSND (unknown [127.0.0.1]) by DDEI (Postfix) with SMTP id 145483440FDD for <[email protected]>; Fri, 17 Jul 2026 13:32:02 +0300 (EEST)

from ISNETGVSND.localdomain (unknown [127.0.0.1]) by DDEI (Postfix) with ESMTP id 28A023440FDD for <[email protected]>; Fri, 17 Jul 2026 13:31:46 +0300 (EEST)

from SMTP2.is.net.tr (unknown [213.143.239.178]) by ISNETGVSND.localdomain (Postfix) with ESMTPS for <[email protected]>; Fri, 17 Jul 2026 13:31:46 +0300 (EEST)

Message-Id

<[email protected]>

Extracted URLs

  • file https://ddei5-0-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fdomainsnamerenewal.com%2finvoice%2f459bcaf1e066426d88775a3a0cb82af6

  • file https://ddei5-0-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fdomainsnamerenewal.com%2finvoice%2f459bcaf1e066426d88775a3a0cb82af6&amp;umid=F4726545-56CB-F106-A70C-E0C49BC6E342&amp;auth=5258729bb5ef5fc8a5eedaae6bf9912ed615de19-e2998fc03122cc4054b6cec05f1f13464c1d8969

  • file https://ddei5-0-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fdomainsnamerenewal.com%2finvoice%2f459bcaf1e066426d88775a3a0cb82af6&umid=F4726545-56CB-F106-A70C-E0C49BC6E342&auth=5258729bb5ef5fc8a5eedaae6bf9912ed615de19-e2998fc03122cc4054b6cec05f1f13464c1d8969