attachment20260930-527357-hvfmks[.]zip

General

Target
attachment20260930-527357-hvfmks.zip
Size 17KB
Sample260930-1scfga1cmd
SHA256 98fc26353cfccf84c5a4060d923c24f5e3f5f9f3b3d3bc2624cfc7df07481afd
MD5 e08f31ba53c9ed1c355f17bfc7f8b1fc
SHA1 9a4b671dcf57e64b942e6478517c95867091141a
SHA512 68826ecb548a7a5fccdd019eae9c184de21a030e31beb977c8463da23bef76eb92692c0080ae1e4549bee2b1e393d441a12ca2ebc68adfd24910a8ead089a7d7
SSDEEP 384:7CzbH9uSJmLLUZskGASrhmDnSUToBRpbiqoT3cnIP:7CzISJmPkGAShGnkSqW3cnIP
TLSH
T1F982E14BB10B94E9983515920CEBEEEF20B547590C58F6C1F938BA72C5A88FE138D179
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

attachment20260930-527357-hvfmks.zip

.zip 17KB
Your_one_time_OneTrust_passcode.eml

.eml 48KB
email-html-1.txt

21KB

attachment20260930-527357-hvfmks.zip

SHA256 98fc26353cfccf84c5a4060d923c24f5e3f5f9f3b3d3bc2624cfc7df07481afd
MD5 e08f31ba53c9ed1c355f17bfc7f8b1fc
SHA1 9a4b671dcf57e64b942e6478517c95867091141a
SHA512 68826ecb548a7a5fccdd019eae9c184de21a030e31beb977c8463da23bef76eb92692c0080ae1e4549bee2b1e393d441a12ca2ebc68adfd24910a8ead089a7d7
SSDEEP 384:7CzbH9uSJmLLUZskGASrhmDnSUToBRpbiqoT3cnIP:7CzISJmPkGAShGnkSqW3cnIP
TLSH
T1F982E14BB10B94E9983515920CEBEEEF20B547590C58F6C1F938BA72C5A88FE138D179
MD5 SHA1 SHA512 SSDEEP TLSH

Your_one_time_OneTrust_passcode.eml

SHA256 7d0f6c0ff5c874621bed446dd883fcf543663d8c888c20d0a187e36d153b2c1a
MD5 4451f16c3d9b041e34581e1fc6ace4e4
SHA1 5e6b38f5d5488a3d0f18524aff310c5504db6821
SHA512 9617b8a98d771ca867647b976ed30bd37cb0eac36811b54ec2be6ada57c9ae2630120038d99fd02ab754f158797f768d9effd2fa42ace388ffdb90b371fb5d4c
SSDEEP 768:S6GC7PH2YVl3UryuciCb8MY+wngJCH2bajXu2srS0jCrC6WiLBth7qZ0TG:S6f9VlgyPiH+EgJCHfjZ0T6pY
TLSH
T1E723F742BE072E53D7B069C318DD29D5150C774BB8F640C86D2FEBA942AE1BE6CF015A
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

bounces+[email protected]

Date

Thu, 31 Jul 2025 16:21:52 +0000 (UTC)

Subject

Your one-time OneTrust passcode

Content-Type

text/html; charset=utf-8

Received

from PH0PR11MB7494.namprd11.prod.outlook.com (2603:10b6:510:283::18) by SJ0PR11MB6814.namprd11.prod.outlook.com with HTTPS; Thu, 31 Jul 2025 16:22:20 +0000

from MN2PR16CA0047.namprd16.prod.outlook.com (2603:10b6:208:234::16) by PH0PR11MB7494.namprd11.prod.outlook.com (2603:10b6:510:283::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8989.11; Thu, 31 Jul 2025 16:22:15 +0000

from BL02EPF0001A0FD.namprd03.prod.outlook.com (2603:10b6:208:234:cafe::74) by MN2PR16CA0047.outlook.office365.com (2603:10b6:208:234::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8989.14 via Frontend Transport; Thu, 31 Jul 2025 16:22:15 +0000

from us.cloud-sec-av.com (35.174.145.124) by BL02EPF0001A0FD.mail.protection.outlook.com (10.167.242.104) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8989.10 via Frontend Transport; Thu, 31 Jul 2025 16:22:13 +0000

from emails-1608236-19-mt-prod-cp-us-2.checkpointcloudsec.com (ip-10-10-7-246.ec2.internal [10.10.7.246]) by mta-outgoing-687-mt-prod-cp-us-2.checkpointcloudsec.com (Postfix) with ESMTPS id 34A167FEE7 for <[email protected]>; Thu, 31 Jul 2025 16:22:13 +0000 (UTC)

from MW4PR03CA0151.namprd03.prod.outlook.com (2603:10b6:303:8d::6) by DS0PR11MB8208.namprd11.prod.outlook.com (2603:10b6:8:165::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8989.12; Thu, 31 Jul 2025 16:21:53 +0000

from CY4PEPF0000E9D7.namprd05.prod.outlook.com (2603:10b6:303:8d:cafe::5e) by MW4PR03CA0151.outlook.office365.com (2603:10b6:303:8d::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8989.11 via Frontend Transport; Thu, 31 Jul 2025 16:21:53 +0000

from o4.live.m.onetrust.com (168.245.74.77) by CY4PEPF0000E9D7.mail.protection.outlook.com (10.167.241.70) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9009.8 via Frontend Transport; Thu, 31 Jul 2025 16:21:52 +0000

by recvd-79cc5f8dff-8f77t with SMTP id recvd-79cc5f8dff-8f77t-1-688B9820-46 2025-07-31 16:21:52.26511 +0000 UTC m=+4923421.158323706

from notification-5799db556-jqz5d (unknown) by geopod-ismtpd-canary-0 (SG) with ESMTP id YduAta5FTjm3k--NLVWGJQ for <[email protected]>; Thu, 31 Jul 2025 16:21:52.194 +0000 (UTC)

Received-Spf

Fail (protection.outlook.com: domain of ots.m.onetrust.com does not designate 2603:10b6:303:8d::6 as permitted sender) receiver=protection.outlook.com; client-ip=2603:10b6:303:8d::6; helo=MW4PR03CA0151.namprd03.prod.outlook.com;

Pass (protection.outlook.com: domain of ots.m.onetrust.com designates 168.245.74.77 as permitted sender) receiver=protection.outlook.com; client-ip=168.245.74.77; helo=o4.live.m.onetrust.com; pr=C

Message-Id

<1673650714.31519.1753978912100@notification-5799db556-jqz5d>

Extracted URLs

file https://protect.checkpoint.com/v2/r01/___https:/www.onetrust.com___.YzJ1OmNvZmVuc2U6YzpvOmIyMTAzZWJjNTVmMzA5ZGRiMWRkNWMzNTkyNzYxNWIxOjc6MzM1YTpmNWI4ZDk3YjBjMTA4ZDA2OGNjZGViMTgyZjA0NGUwMzMwNmY0ZmJkMmRmMWMwYTZhM2Y5OGU3YzNjNzc0MTRhOmg6VDpO

Sharing