attachment20260930-1253-lf2pm3.zip
- SHA256 1b25a98d5a6393a2776901aeca87422a16f6899a09483665cd4853a24102f5d5
Static task
static1
General
- Target attachment20260930-1253-lf2pm3.zip
- Size 21KB
- Sample260930-glv5fssckc
- SHA256 1b25a98d5a6393a2776901aeca87422a16f6899a09483665cd4853a24102f5d5
- MD5 b982d137af890c4be1f9233bb8a6507d
- SHA1 ea1ac8651b1c591ed31cdfd34fe4445d6c690478
- SHA512 337dad2d90d9d0765c6d798a467610699b2ec13ac2dec7464a7cb24711c83ba660ccd5428679a78484c70eb825981a4d2662eb75fc4995b1742317dfefb65c99
- SSDEEP 384:PASlMWeE3sB+PKnzyk4o1e0/VUyqou0C4y4HsR1Ph8ZNe3GKgG8j2lipVjuO:PACMwSHe2uoZpy4HiKeiNAip51
- TLSH T1BBA2D1B89DDC2DDB9CA17EB475123DA34CB6900A3CA62385A5111EB3B6A40414F9CFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
attachment20260930-1253-lf2pm3.zip.zip 21KB
-
_POTENTIAL_PHISH_CCC_Staging_2411_Security_Awareness_Newsletter_Holiday_Invitation_Themed_Phishing_Emails.eml.eml 43KB
-
Security_Awareness_Newsletter_Holiday_Invitation_Themed_Phishing_Emails.eml.eml 18KB
-
email-html-1.txt.html 7KB
-
email-plain-1.txt14KB
_POTENTIAL_PHISH_CCC_Staging_2411_Security_Awareness_Newsletter_Holiday_Invitation_Themed_Phishing_Emails.eml
- SHA256 df4157dbfc055b4eb24d2e438a7e214993fff01583e6fd599936fe81c2147e97
- MD5 e05095be0cc74278a23e9ad99ae447d2
- SHA1 e8a7fff51833be9a61d539ccc7b6423b69a528cb
- SHA512 8f56005574fa8e72228895548f5f2101234aed3a16de5dc9fae19018c9052d652fc7bd91aaeb202d2101d2fb1a0f6cbd86c4b73ee2aee62a971d1b0105775c7d
- SSDEEP 768:sB00mtY1mxlypwqWe4ecOk/mdk+cDfaakaZDpAFokM6zLnhNycjUoU2v:sP18ypAHkasOkDLnrTv
- TLSH T11F136C554E566C13D31AA18988DE59CC49AEF7D6A0E340C93F0F38C867CE0B57EF6889
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
Date
Mon, 24 Nov 2025 19:34:43 +0000
Subject
[POTENTIAL PHISH] CCC Staging 2411 - Security Awareness Newsletter: Holiday Invitation-Themed Phishing Emails
Content-Type
multipart/mixed; boundary="_002_CO6PR16MB40526A18FE9426D68372A4DA94D0ACO6PR16MB4052namp_"
Received
from IA2PR16MB6426.namprd16.prod.outlook.com (2603:10b6:208:4af::13) by CO6PR16MB4052.namprd16.prod.outlook.com with HTTPS; Mon, 24 Nov 2025 19:34:48 +0000
from CO6PR16MB4052.namprd16.prod.outlook.com (2603:10b6:303:b1::7) by IA2PR16MB6426.namprd16.prod.outlook.com (2603:10b6:208:4af::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.17; Mon, 24 Nov 2025 19:34:44 +0000
from CO6PR16MB4052.namprd16.prod.outlook.com ([fe80::ee07:be86:bed4:4ad8]) by CO6PR16MB4052.namprd16.prod.outlook.com ([fe80::ee07:be86:bed4:4ad8%5]) with mapi id 15.20.9343.011; Mon, 24 Nov 2025 19:34:43 +0000
Message-Id
<CO6PR16MB40526A18FE9426D68372A4DA94D0A@CO6PR16MB4052.namprd16.prod.outlook.com>
Extracted URLs
-
file http://AhV3cTpms4e.smbstaging.hr-communications.org/1/f8c081ec-b195-45bb-bd43-1f9bb8a57695.png
-
file http://AhV3cTpms4e.smbstaging.hr-communications.org/2/f8c081ec-b195-45bb-bd43-1f9bb8a57695.png
-
file http://AhV3cTpms4e.smbstaging.hr-communications.org/3/f8c081ec-b195-45bb-bd43-1f9bb8a57695.png
-
file http://AhV3cTpms4e.smbstaging.hr-communications.org/4/f8c081ec-b195-45bb-bd43-1f9bb8a57695.wav
-
file http://AhV3cTpms4e.smbstaging.hr-communications.org/5/f8c081ec-b195-45bb-bd43-1f9bb8a57695.gif
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/0dd/51c/ef-/original/Party.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/110/b54/61-/original/reporter.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/138/6fe/18-/original/no3.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/2d9/6a0/24-/original/no2.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/61e/244/53-/original/Punchbowl.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/c03/fce/02-/original/Invitation.png
-
file http://images.smbstaging.pmeimg1.com/system/content_images/uploads/fb5/699/0d-/original/no1.png
-
file http://www.w3.org/1999/xhtml
-
file http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
- Show all
Security_Awareness_Newsletter_Holiday_Invitation_Themed_Phishing_Emails.eml
- SHA256 50995ea89000f9059027c5a45429638cf68b416ed6bc0f945ded01f818ad29da
- MD5 c2a595b3f65c8a5bd8e57feefdebcfe2
- SHA1 b8bc720dad609e7faf23666e99a312579633b7f7
- SHA512 cbb70fb8812f39bcba91c6ccf1ec2e4c7c597a898999604e7c9fa003ef8a14b817e28d5432d77158f9d370ec02360a0829846105a5c6ed288bde292b53ce2984
- SSDEEP 384:+w3cQ3e3RhlF9mxlytjim/MqDdoR510HVTyaRMa:+qcQ3Y1mxlypwqdHVTbRMa
- TLSH T11382D5654383A527C7718094AC111D098F61B98BE2378480791F25BF1FEE436AF7BACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
Return-Path
Date
Thu, 20 Nov 2025 14:22:19 +0000
Subject
Security Awareness Newsletter: Holiday Invitation-Themed Phishing Emails
Content-Type
text/html; charset="UTF-8"
Received
from DS5PPF03945C460.namprd16.prod.outlook.com (2603:10b6:f:fc00::7c4) by CO6PR16MB4052.namprd16.prod.outlook.com with HTTPS; Thu, 20 Nov 2025 14:22:28 +0000
from BYAPR02CA0044.namprd02.prod.outlook.com (2603:10b6:a03:54::21) by DS5PPF03945C460.namprd16.prod.outlook.com (2603:10b6:f:fc00::7c4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.11; Thu, 20 Nov 2025 14:22:22 +0000
from SJ1PEPF0000231A.namprd03.prod.outlook.com (2603:10b6:a03:54:cafe::e5) by BYAPR02CA0044.outlook.office365.com (2603:10b6:a03:54::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9343.11 via Frontend Transport; Thu, 20 Nov 2025 14:22:22 +0000
from postfix-smtp.pm-smbstaging.smb-staging.phishme.com (52.70.33.20) by SJ1PEPF0000231A.mail.protection.outlook.com (10.167.242.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.9 via Frontend Transport; Thu, 20 Nov 2025 14:22:22 +0000
from phishme.com (ip-172-22-147-167.ec2.internal [172.22.147.167]) by postfix-smtp.pm-smbstaging.smb-staging.phishme.com (Postfix) with ESMTP id 4dC0t530Njz38Hp for <[email protected]>; Thu, 20 Nov 2025 14:22:21 +0000 (UTC)
Received-Spf
Pass (protection.outlook.com: domain of return--path.com designates 52.70.33.20 as permitted sender) receiver=protection.outlook.com; client-ip=52.70.33.20; helo=postfix-smtp.pm-smbstaging.smb-staging.phishme.com; pr=C
Message-Id
email-html-1.txt
- SHA256 16ea42f6438511061638f3c3135367ad9d72ef89dc6a9531ec0ed97d7428d02f
- MD5 8e7d4f426204b5eaeef6b272d4eb1523
- SHA1 fb1292275a792ad132ea203c2f4f1f4cfb21d4e8
- SHA512 cb1c5772dd708f972ef91572e1ac940b59275d42930c6b23cb2e60c7deb25cce3fb78543c17195859da83e5a707746c0efd3b6fb5b29e745d8ca25d2473935c2
- SSDEEP 192:C1PJnMoy0WyjJFrC0S2PqYv8HXXZXTyaRMFQ:3oR510HVTyaRMa
- TLSH T196F123AA47C6F64F05318071F9221D54CFA2859F43024894796F299BAFBDC029B7B7CD
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 7ba35b776adbc0adc6e7882295900d2490c73c685d7a4aadf2e5b5a3c389309c
- MD5 0fa83008f8db160e955c54b160eda129
- SHA1 2ac806e12c57474b6edde53b8a6b0652ad4c5e30
- SHA512 9e118aae2d5beaaa8c71b8169fa738ad87e5e0f7460e532e9711d300099b023f936cfdcee6e3d584bfa2e0f863a827b64fb3c60616c923df6e198ade9b869d17
- SSDEEP 384:HbZWA70mte3RhlF9mxlytjim/MqDlzt/ZIe4ecOk/mdkIb1ZID4:k00mtY1mxlypwqWe4ecOk/mdk+cD4
- TLSH T14E62D790471AD437D7A5C2849C155E0E8721FD85E8BB84487E1F28BA06CE0767FBBD8C
- MD5 SHA1 SHA512 SSDEEP TLSH