attachment20260930-1253-9f5hlk[.]zip

attachment20260930-1253-9f5hlk.zip

SHA256 f819cacd1d46e14bf98043b6269eb345c62edb58c2cc44fcad9858a23c534432
MD5 53cba00d8bf7b6c800639310cd6b3aad
SHA1 228db420fe39559355724435afde3bfc73b8a28d
SHA512 5cf0029bc4e809ff95f4b11d21a9f13221b7a50cb33ae5a0e4c1603d6b367276297f4eb29cb25129b0e4fa2745fd85b8721d46a0676a13fa85f704406e63c911
SSDEEP 12288:NXQT4yqyTBNThY5DEibHdE2eJFALlg2R8cvP:3yHFCZ9E2NLlg26o
TLSH
T17A9423B71C9C5D0FB612C992FBAB052B76FF2BB09B86607834DB30904D4783497D9A25
MD5 SHA1 SHA512 SSDEEP TLSH

triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html

SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

triage-report_10522-thomas_schuetz_AT_bwb-group_com/headers.txt

SHA256 6cb1b796ecb2e62782b853019823653116d88eda5c609d99d38a4fa6e43eddfb
MD5 2ef7d846810faa31751222ad7e824eb4
SHA1 89cd85a9f43b06bbf696cf7db31a88b19fe5898a
SHA512 4cee1b0f68efde4dbf0de0e71a5ec6ff8d200741c64029d09c093876470c6200ab69c455251612e34e00c3513da57624bf125de3a7aa3954a741b6ba6e748126
SSDEEP 384:T7UofpShTrw7K/bdihu5dltVdLdkyrm7xiMf0z:T7UofwTriK/bMhunltzhkym7xiMMz
TLSH
T135524C60AB692564E9C366C53D11FD0762961ED09AFFE0D0355D4DE1034F0EB8B2B44A
MD5 SHA1 SHA512 SSDEEP TLSH

triage-report_10522-thomas_schuetz_AT_bwb-group_com/original.eml

SHA256 925a27ddf79edb1745e85dd87e7d027bdc2b571215f1394c6c5e9ca12897972a
MD5 abc8460166d10edca75e1952520dfefc
SHA1 66e1eeae8fc119d05339f109f978f1676db7361d
SHA512 1043d91def12840f3a757ed8044d0b8dd28bc7945bfbbe984abae4ee5bad2862aa533e976bb81aa92fb29cd9ecbc4d54ce2e558a96bf256cb1af1ab2bd4413ca
SSDEEP 6144:iNtKeKV4UkhUdYjHoZEXAXW0o5a7IzmRiqWYJhiiBmJ9DrIJ4m0zn:iNtKemkhAaHj0o5a7IzSiqmDDC4zn
TLSH
T10564F1B13E4429977077C7A2B4017F8E1BA035885DB621A1F16D8EE72EDB8D8C75D780
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

Delivered-To

From

Return-Path

Date

Tue, 9 Jan 2024 10:16:33 +0000

Subject

[POTENTIAL PHISH]

Content-Type

multipart/mixed; boundary="_004_ZR0P278MB0697AEB4D5FEAA4198F5D430BF6A2ZR0P278MB0697CHEP_"

Received

from CHE01-ZR0-obe.outbound.protection.outlook.com (mail-zr0che01on2046.outbound.protection.outlook.com [40.107.24.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.manls.ch (Postfix) with ESMTPS id 05D762004E for <[email protected]>; Tue, 9 Jan 2024 10:16:41 +0000 (UTC)

from ZR0P278MB0697.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:26::8) by GV0P278MB0019.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:27::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.23; Tue, 9 Jan 2024 10:16:33 +0000

from ZR0P278MB0697.CHEP278.PROD.OUTLOOK.COM ([fe80::511:b39f:203a:79a0]) by ZR0P278MB0697.CHEP278.PROD.OUTLOOK.COM ([fe80::511:b39f:203a:79a0%4]) with mapi id 15.20.7159.020; Tue, 9 Jan 2024 10:16:33 +0000

Message-Id

<ZR0P278MB0697AEB4D5FEAA4198F5D430BF6A2@ZR0P278MB0697.CHEP278.PROD.OUTLOOK.COM>

email-html-2.txt

SHA256 82627f900584384a9d4976f6fc701087e6c5091863e5bcd4b11db7105b7c372e
MD5 34ade5bc1c6deff5b9f45563c148bdd3
SHA1 105c2606c1cf81dc32c851deb6e358778b955cea
SHA512 14b30dadf426f910734ea474c81ac2a000f2438d827baf8453985ed6bb5c8ce2ec22d34da1e10e7a846099de22ee3fcbdd807993dc39405ff0bd4150ac63a7a6
SSDEEP 384:WWRLTF9pcO7K/aQPdDd8tvCzmZ1i68dNt6WPrms:RTF7c0K/aMZ8tvgmZ1i6ANE2
TLSH
T1D8A272F13B081E9678A3CF73F402BF4E5F5130A47A7562A2F02E6EC716C60A98759794
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 0849526852898083d3c4e6e31aec9ef9d894c8a28eeeb9da05103f2bf5ebb5ff
MD5 05545015b145b38e3dbfd6987af6a229
SHA1 29c4d7fe24ccc6c0f79ba84cac42ee76a682f189
SHA512 c8f0a131a319328b88e463910bdae0897041b290f33c72ba7011f97a830703043f9ad6082ce8de8bb6d0b894fa067dcaca192077be2617a81622b4d621531d79
SSDEEP 384:HbM7T3kwbcEw7K/do6Aud8tVyrm7xiL2dYd1f0U9YiF:eT3kYcEiK/d668tVym7xiLic1M6
TLSH
T1C0624A60AF692574E9C296C63D02FD0BA3572D91EAFBA0D0316D4DD4138F0EB4B2F44A
MD5 SHA1 SHA512 SSDEEP TLSH

unnamed_email.zip

SHA256 9da4d2ff6c945f3d95bf114db03af98acc207943d8e6bf9c69c7dcc5cc8204c1
MD5 7a2336b3a203e7f1b7763c64ceccc95b
SHA1 5d724f04f11bc2c4aaa670a37f16f845b589e6eb
SHA512 b43e4b3af8cd154eb5b96bde88f9ba22a8dbd73482ad6f88cb0e5818bac4d7148847a55a184f69f8ce3aa1a182bfa18daa0749384c06e9be26e4da9b11df98ce
SSDEEP 6144:yxoGdACSg8A2UdMaJQdNQAc/Uz9fAMP1U8rA1aWD:p88JUGa6NRcULK801aK
TLSH
T18914123AB38D269D306A33F071D5F72CA9D002E6EE9A2A97DE51E4307608CA55F1354F
MD5 SHA1 SHA512 SSDEEP TLSH

unnamed_email.msg

SHA256 664c579851baa1810e3a4dbb2f92cb9876ec944f84be6ba1fcccafcc0d78d9f1
MD5 769b5423dcfb0985add2b664e23bc101
SHA1 cc072c1455a44cc3531d07b0aefbc9248c47e14f
SHA512 74dea706e87f5697314eb0029fe71648b9ef810fdf06c0fb686cf5ae997fab612e6ec51e41633c8a01e01f866e418972cb29d04e620ccdb40811723b65110e9c
SSDEEP 6144:EGQTvs0B0kjACPENRyZduupQPNQAG/Uj9fAMPNU8xp:EGQTvs0BlnZsueNRGuLC87
TLSH
T15D54D02035999A08F27A4F7A1ED3E08B81117DC2DFD1978BB3A1736F05369C1E97291B
MD5 SHA1 SHA512 SSDEEP TLSH

triage-report_10522-thomas_schuetz_AT_bwb-group_com/raw.eml

SHA256 8f6c37c7724b38281b797b2016b2c7cca642574aed4f56677832861dbf16e940
MD5 7b505c66eecb6287c8ea1a4371c339f3
SHA1 d4208ca61b9caf40b0a958613fafc48b04ca3944
SHA512 158a5594d54ed087be8289fe8f230dab0368199dd2cae4085138899be2ac457904da72bb38f68ed5e9a08a36b71d875506296d0f7c3bcb9a66a0db4cb91923a4
SSDEEP 6144:oPdMFJibA//z85yAAafR+VO0UHCFy+iDfRk/rHO1czruzO/Idas:oPdMF8bGrG1ASIMCaDfSOCzqqgdT
TLSH
T139541203ED57306D87202BF77717FC8592B72EC798C70A9892EC8D2C31B89789B51A56
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

<[email protected]>

Date

Tue, 09 Jan 2024 10:14:13 +0000

Subject

Thread-Index: AQHaQuSYSGxZ6Z9GKkS/qjH15+jDDw==

Content-Type

multipart/related; boundary="----_=_NextPart_001_0004c888.659d1d16"

Received

from GVAP278MB0745.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:47::10) by ZR0P278MB0697.CHEP278.PROD.OUTLOOK.COM with HTTPS; Tue, 09 Jan 2024 10:15:05 +0000

from AS9P194CA0007.EURP194.PROD.OUTLOOK.COM (2603:10a6:20b:46d::21) by GVAP278MB0745.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:47::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.23; Tue, 09 Jan 2024 10:14:18 +0000

from AM2PEPF0001C716.eurprd05.prod.outlook.com (2603:10a6:20b:46d:cafe::e5) by AS9P194CA0007.outlook.office365.com (2603:10a6:20b:46d::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.23 via Frontend Transport; Tue, 09 Jan 2024 10:14:17 +0000

from CHE01-GV0-obe.outbound.protection.outlook.com (40.107.23.110) by AM2PEPF0001C716.mail.protection.outlook.com (10.167.16.186) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7181.13 via Frontend Transport; Tue, 09 Jan 2024 10:14:17 +0000

from ZRAP278MB0269.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:1e::12) by ZRAP278MB0016.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:12::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.23; Tue, 09 Jan 2024 10:14:13 +0000

from ZRAP278MB0269.CHEP278.PROD.OUTLOOK.COM ([fe80::58c7:ae28:1457:8494]) by ZRAP278MB0269.CHEP278.PROD.OUTLOOK.COM ([fe80::58c7:ae28:1457:8494%7]) with mapi id 15.20.7159.020; Tue, 09 Jan 2024 10:14:13 +0000

Received-Spf

Pass (protection.outlook.com: domain of bwb-group.com designates 40.107.23.110 as permitted sender) receiver=protection.outlook.com; client-ip=40.107.23.110; helo=CHE01-GV0-obe.outbound.protection.outlook.com; pr=C

Message-Id

<ZRAP278MB0269B53F9E9822F46E2798E1D46A2@ZRAP278MB0269.CHEP278.PROD.OUTLOOK.COM>

attachment-3.pdf

SHA256 8905d3eda6c78db00faccf89432948b914b536015de2a773f65c014a2305d3e8
MD5 33765d256b07839fa753dadb3c459e06
SHA1 af4d5138b0a03909a90d1d94380ca7332cda5588
SHA512 9c366de57e0ce54e839e1910989e700393765f1fc6422b62fb33737943f8029cc032df5938ed11486ad21ad67d4dca726e04d463b74cd41ee64e0d176e25bfc9
SSDEEP 3072:J2zb9LCoYwACPENR1cVGonwcd8Pf9oUMnQdxsdzONQAG/Uj9fAMPNU8LBTX:JkjACPENRyZduupQPNQAG/Uj9fAMPNUw
TLSH
T1E014127D715C264CD85A9BED7359F52C9A8033E38BC93D93C4768093128AEE9BE23107
MD5 SHA1 SHA512 SSDEEP TLSH

Extracted URLs

file http://2023group.com/fr/telechargements/#CGV
file http://bwb-group.comwww.bwb-group.com

email-html-2.txt

SHA256 d4be5a0e33b508582275bb41dc4f780596f8276a3f7bc6823e8123eeab9f6785
MD5 ffcb73981359ca10419a2bb693a14d4b
SHA1 38fbc65e7f28309e9eef6139c3b281399e270d21
SHA512 39080a8b0d58a2c787207b27400e3b40f6cef28174f82fefc4e721655d4db11e2cd54e5b7d1b339688d21792a92a0689f9e745d5f0e74e04d98886a30bb0bb3e
TLSH
T153B0927F13570C0A79B01E366DD277670407668A025A2B2021A6C9ABEEC70A29F8334C
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

attachment20260930-1253-9f5hlk.zip

triage-report_10522-thomas_schuetz_AT_bwb-group_com/body.html

triage-report_10522-thomas_schuetz_AT_bwb-group_com/headers.txt

triage-report_10522-thomas_schuetz_AT_bwb-group_com/original.eml

Email Headers

email-html-2.txt

email-plain-1.txt

unnamed_email.zip

unnamed_email.msg

triage-report_10522-thomas_schuetz_AT_bwb-group_com/raw.eml

Email Headers

attachment-3.pdf

Extracted URLs

email-html-2.txt