Overview

overview

3

Static

static

1

Message.eml

windows10-2004-x64

1

Message.eml

windows11-ltsc_2024-x64

1

INVEST Upd...s.pptx

windows10-2004-x64

1

INVEST Upd...s.pptx

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

image001.png

windows10-2004-x64

1

image001.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 19.4MB
  • Sample261001-xdvrqaab34
  • SHA256 95dcdf8986540a291fe3a2a5aba80fe7b52f95599a957d15065f14e93b19bf77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 19.4MB
  • INVEST Updates - Class Snapshots - Talking Points.pptx
    .pptx 14.1MB
  • email-html-2.txt
    .html 8KB
  • email-plain-1.txt
    1KB
  • image001.png
    .png 120KB

Message.eml

  • SHA256 95dcdf8986540a291fe3a2a5aba80fe7b52f95599a957d15065f14e93b19bf77
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

DS0PR12MB9992645A83F37AAE2FA81042DA8C8C2@DS0PR12MB999264.namprd12.prod.outlook.com

Date

Wed, 30 Sep 2026 16:06:25 +0000

Subject

FW: Invest Program

Content-Type

multipart/mixed; boundary="_006_DM6PR13MB3641F01061B7167CE4F468CD918B2DM6PR13MB3641namp_"

Received

from DM6PR13MB3641.namprd13.prod.outlook.com (2603:10b6:5:247::20) by LV3PR13MB6897.namprd13.prod.outlook.com (2603:10b6:408:27b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Wed, 30 Sep 2026 16:06:26 +0000

from DM6PR13MB3641.namprd13.prod.outlook.com ([fe80::231d:f921:cf9b:47b1]) by DM6PR13MB3641.namprd13.prod.outlook.com ([fe80::231d:f921:cf9b:47b1%4]) with mapi id 15.21.0451.026; Wed, 30 Sep 2026 16:06:25 +0000

Message-Id

<DM6PR13MB3641F01061B7167CE4F468CD918B2@DM6PR13MB3641.namprd13.prod.outlook.com>