attachment20260930-527357-owla4f.7z
- SHA256 91e30d7512a5a2820646091404081a72a39fa3be858340c78442ba7c17d4a243
Static task
static1
General
- Target attachment20260930-527357-owla4f.7z
- Size 29KB
- Sample260930-1pvsms1aqd
- SHA256 91e30d7512a5a2820646091404081a72a39fa3be858340c78442ba7c17d4a243
- MD5 1496f205237ed066cc92b3779809802c
- SHA1 2edab70fc2ce43769cb64f33c52647ee7bc2b527
- SHA512 f1a477ada675d9b192b06e5a3c81e6929ebf8154ba3d180135b18baf72b0f7b493910a2c684bd8713c3aa89ebd39316195a8a8813dbbb4c558d917dd80775f45
- SSDEEP 768:eWRqUEMcDOIPTeAYTq/TMdwskvlucIm1oiHFdJ:TiMoOIPTe/yMdnkMcJ1oifJ
- TLSH T122D2F1F0477BE51AF798FE68ECB23822FF2742CEA09B53CF65024A064867452385AD54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
attachment20260930-527357-owla4f.7z.7z 29KB
-
_Phish Alert_ FW_ _External_ .msg.msg 93KB
-
rrmqrtts.eml.eml 15KB
-
email-html-2.txt.html 1KB
-
email-plain-1.txt1KB
_Phish Alert_ FW_ _External_ .msg
- SHA256 20dc0b5524b59d3461c428aefc716dbcc6d2b70fa8381d010419af13a4961cb9
- MD5 8287b645dab0f7a464ce82a505e849ed
- SHA1 e36031ad4026585491ca266e08e1b80351627699
- SHA512 38445e6434eea9925003479334ec3fa454c0edd4feb76dbc43253e880d9d81a5df975ada826362c3a059d68d0b681763c4e42a2239cf6867b25e7a477af0de71
- SSDEEP 1536:31ZQWsWHWLwbkWDkXr4od2snnW8W7Q9AUCrc7f:31Znby0odLnmQj7
- TLSH T1E89395213AF94215F2BBAF7219F2D0979636BC91ED11C68F7291730E1972940A931F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
Return-Path
Date
Thu, 14 Oct 2021 17:02:38 +0000
Subject
[Phish Alert] FW: [External]
Content-Type
application/ms-tnef; name="winmail.dat"
Received
from PH0PR09MB8860.namprd09.prod.outlook.com (2603:10b6:510:6b::17) by SA9PR09MB5917.namprd09.prod.outlook.com with HTTPS; Thu, 14 Oct 2021 17:02:42 +0000
from PH0PR09MB7529.namprd09.prod.outlook.com (2603:10b6:510:68::10) by PH0PR09MB8860.namprd09.prod.outlook.com (2603:10b6:510:6b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16; Thu, 14 Oct 2021 17:02:39 +0000
from PH0PR09MB7529.namprd09.prod.outlook.com ([fe80::3486:a356:cbca:e34f]) by PH0PR09MB7529.namprd09.prod.outlook.com ([fe80::3486:a356:cbca:e34f%7]) with mapi id 15.20.4608.016; Thu, 14 Oct 2021 17:02:39 +0000
Message-Id
<PH0PR09MB7529DFDCB1DED85F460C10E3F2B89@PH0PR09MB7529.namprd09.prod.outlook.com>
Extracted URLs
-
file http://aol.com
-
file http://aregato.bid
-
file http://brockhunterlaw.com
-
file http://bunmbuzz.com
-
file http://callapp.info
-
file http://carhop.com
-
file http://carmax.com
-
file http://cbburnet.com
-
file http://centurylink.net
-
file http://chadani.club
-
file http://charitine.com
-
file http://charter.net
-
file http://chatjoy.inc
-
file http://click2sell.co
-
file http://comcast.net
-
file http://compute.amazonaws.com
-
file http://cornerstoneauto.com
-
file http://cp20.com
-
file http://daynwua.win
-
file http://ec2-34-216-121-199.us-west-2.compute.amazonaws.com
-
file http://ec2-52-10-143-69.us-west-2.compute.amazonaws.com
-
file http://ec2-52-41-16-145.us-west-2.compute.amazonaws.com
-
file http://edtrapp.com
-
file http://emcomnder.club
-
file http://flextrig.com
-
file http://givemall.club
-
file http://globalcheck.xyz
-
file http://gmail.com
-
file http://gracetrinitychurch.org
-
file http://hennepin.us
-
file http://hotmail.com
-
file http://icanshop.bid
-
file http://icanshop.us
-
file http://infiniti-bloomington.com
-
file http://lenienci.com
-
file http://letmetakeit.bid
-
file http://letmetakeit.online
-
file http://letmetakeit.us
-
file http://lexingtonlaw.com
-
file http://lt.life
-
file http://makemak.xyz
-
file http://makemehappy.loan
-
file http://mergedragons.com/invite
-
file http://msn.com
-
file http://mydmco.com
-
file http://omnibox.space
-
file http://outlook.com
-
file http://propocket.tv
-
file http://spscoach.com
-
file http://tawfikbox.review
-
file http://trapp.com
-
file http://trellismn.org
-
file http://uniqdeals.net
-
file http://us.army.mil
-
file http://whattoshop.loan
-
file http://yahoo.com
- Show all
rrmqrtts.eml
- SHA256 c818ce48e553d57ab9d869065c94a8421754d3138f18ac7117f8b3db4ac7677e
- MD5 8177f0cb843320b37f44f2855a403003
- SHA1 3531f7cad417bb3050b1ef4f77a0aea8255a6918
- SHA512 bb6e9331cf2f600774ff823e4ac02608b4edbb7a6888171332f9ef358f21c2a9d37d845d737f9049d85d89302a4188849faf096c207184c47e61b101c6f23e02
- SSDEEP 192:69eVSRnHHSp+AH/B+2rcob4LxBZQGZaq+H4nXxsDTX+rPUbzaL3D8F1dID/bFNl6:6MVSRnDAf7XMztZs3zQ3D8WDhNl10
- TLSH T12E722A770CD8103A8993B3FA7944BE1582268FA9EB6BF4F6BA7C44430397C596B158C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
Return-Path
Date
Fri, 8 Oct 2021 11:43:03 -0500
Subject
[External]
Content-Type
Multipart/alternative; charset=windows-1252; boundary="00B0FEED_message_boundary"
Received
from SJ0PR09MB6302.namprd09.prod.outlook.com (fe80::8549:3cd5:f5:16bc%7) by SJ0PR09MB6302.namprd09.prod.outlook.com with HTTPS; Fri, 8 Oct 2021 16:44:21 +0000
from DM6PR09CA0003.namprd09.prod.outlook.com (2603:10b6:5:160::16) by SJ0PR09MB6302.namprd09.prod.outlook.com (2603:10b6:a03:263::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.18; Fri, 8 Oct 2021 16:43:19 +0000
from DM3GCC02FT005.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d04::204) by DM6PR09CA0003.outlook.office365.com (2603:10b6:5:160::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.18 via Frontend Transport; Fri, 8 Oct 2021 16:43:18 +0000
from mail-ua1-f45.google.com (209.85.222.45) by DM3GCC02FT005.mail.protection.outlook.com (10.97.8.206) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4587.18 via Frontend Transport; Fri, 8 Oct 2021 16:43:18 +0000
by mail-ua1-f45.google.com with SMTP id g13so6562930uaj.3 for <[email protected]>; Fri, 08 Oct 2021 09:43:18 -0700 (PDT)
Fri, 8 Oct 2021 11:44:22 -0500
X-Received
by 2002:ab0:5684:: with SMTP id a4mr4091921uab.79.1633711397946; Fri, 08 Oct 2021 09:43:17 -0700 (PDT)
Received-Spf
Pass (protection.outlook.com: domain of gmail.com designates 209.85.222.45 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.222.45; helo=mail-ua1-f45.google.com;
Message-Id
<CAEXp0NJ6A0ZxPsGU3B4cfL3xE4nNdNpzFv4nDmYZB6y5X9rx-w@mail.gmail.com>
Extracted URLs
-
file http://mergedragons.com/invite
-
file https://gcc02.safelinks.protection.outlook.com/?url=
email-html-2.txt
- SHA256 b86f03c6e1691b0c0f2fee26bd26614f4fe66c9e5dcd5feb7e7fd391fa0060f6
- MD5 bb1f3376908c9aa794766c0dd0f2cac5
- SHA1 34a21d4b89f417a6d43d5189702317cf25417581
- SHA512 71711f3d1f9a3f5ff1119eb7b4b83208ca33b59f3de3b41d985d3e7b9f671297e4c525906a8bff8a0d99f24adc241342057c3e7be04015e1960d91cd84a3adbb
- TLSH T1DB31C5EF0590188E1B331A76F5CAA294E32362DD7B3C6BA82CD048C3034130ABB701D5
- MD5 SHA1 SHA512 TLSH
email-plain-1.txt
- SHA256 7e7d1133881a6740c6a0849d07ea276aa3aecabedee639dfe87abc3b1ad06031
- MD5 0ad0b3f15af42caf5f8c2bee22726997
- SHA1 04edb34158b391828917ca30a320289d3a8f15ca
- SHA512 08dad24d633d6e5cda6b52db2b083e2181c743937ca8cf3bef247ef8c3eaf8dd6a5006efa4bdbaaee7c9d49d5963f8f561ecf51f38568f4ebd673fa117ad05a6
- TLSH T1C821748F1990518F5B271597FAC96258F37360DC3B6C77B83CC648D5035062AB5B01D4
- MD5 SHA1 SHA512 TLSH