Overview

overview

8

Static

static

8

20260930_1...tz.eml

windows10-2004-x64

1

20260930_1...tz.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    20260930_145125_Po4V_MzqEDFnUgAWhUTcnl0_3Xv3-dtz.eml
  • Size 31.3MB
  • Sample260930-ykws2azsft
  • SHA256 1f5c35a0c9f08b5c0e804a6c3c5522e0c3d0a57d6c64d8abcac48c7806e6a292
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
macromacro_on_action

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Office macro that triggers on suspicious action 2 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

File Explorer

  • 20260930_145125_Po4V_MzqEDFnUgAWhUTcnl0_3Xv3-dtz.eml
    .eml 31.3MB
  • Draft Report 103141820COL-002.xlsm
    .xlsm 3.0MB
  • Draft Report 104177963COL-001.xlsm
    .xlsm 7.5MB
  • Draft Report 104510975COL-001.xls
    .xls 7.1MB
  • Draft Report 104577256COL-012.xls
    .xls 2.4MB
  • Draft Report 104577256COL-013.xls
    .xls 2.4MB
  • email-html-2.txt
    .html 39KB
  • email-plain-1.txt
    11KB
  • image002.png
    .png 4KB
  • image003.png
    .png 980B
  • image004.png
    .png 712B
  • image005.png
    .png 1KB
  • image006.png
    .png 1KB
  • image007.png
    .png 60KB
  • image008.png
    .png 2KB
  • image009.png
    .png 4KB
  • image010.png
    .png 372KB
  • image011.png
    .png 2KB

20260930_145125_Po4V_MzqEDFnUgAWhUTcnl0_3Xv3-dtz.eml

  • SHA256 1f5c35a0c9f08b5c0e804a6c3c5522e0c3d0a57d6c64d8abcac48c7806e6a292
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

LVXPR20MB9947339104A3FB78967810BF959A8B2@LVXPR20MB994733.namprd20.prod.outlook.com

Date

Wed, 30 Sep 2026 14:50:52 +0000

Subject

[Virus trojan.tr/snh] RE: Schedule Confirmation For Intertek Proposal Qu-01598171 to Jackson WWS Inc.

Content-Type

multipart/mixed; boundary="_019_DSWPR03MB989165083E44586E346C8D937AF18B2DSWPR03MB989165_"

Received

from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11010039.outbound.protection.outlook.com [40.93.198.39]) by mx0a-0025c601.pphosted.com (PPS) with ESMTPS id 4h086s6dcp-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Wed, 30 Sep 2026 14:51:26 +0000 (GMT)

from DSWPR03MB989165.namprd03.prod.outlook.com (2603:10b6:8:362::23) by SN7PR03MB7153.namprd03.prod.outlook.com (2603:10b6:806:353::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Wed, 30 Sep 2026 14:50:53 +0000

from DSWPR03MB989165.namprd03.prod.outlook.com ([fe80::8cfa:7a88:400e:6074]) by DSWPR03MB989165.namprd03.prod.outlook.com ([fe80::8cfa:7a88:400e:6074%4]) with mapi id 15.21.0451.026; Wed, 30 Sep 2026 14:50:53 +0000

Message-Id

<DSWPR03MB989165083E44586E346C8D937AF18B2@DSWPR03MB989165.namprd03.prod.outlook.com>

Extracted URLs

  • file http://www.intertek.com

  • file http://www.intertek.com/

  • file http:/www.jacksonwws.com/

  • file https://urldefense.com/v3/__

  • file https://www.facebook.com/JacksonWarewashingSystems/

  • file https://www.instagram.com/jacksonwarewashing/

  • file https://www.intertek.com/amazed/

  • file https://www.jacksonwws.com/

  • file https://www.linkedin.com/company/jackson-wws-inc-/

  • Show all