Overview

overview

3

Static

static

1

552b943246...24.eml

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    552b94324672946c4a3214b18e539424.eml
  • Size 28KB
  • Sample261002-r438wsvtb1
  • SHA256 a68186ba540f872fa2377ff545466212a505e1f6b139750b0811c2e928699520
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 552b94324672946c4a3214b18e539424.eml
    .eml 28KB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    1KB

552b94324672946c4a3214b18e539424.eml

  • SHA256 a68186ba540f872fa2377ff545466212a505e1f6b139750b0811c2e928699520
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 1 Oct 2026 22:00:46 +0000

Subject

Action Needed: A new correspondence from Truenorth is awaiting your review.

Content-Type

multipart/alternative; boundary="===============84309073450472360663=="

Received

from BN9PR03CA0573.namprd03.prod.outlook.com (2603:10b6:408:10d::8) by IA6PR20MB994568.namprd20.prod.outlook.com (2603:10b6:208:5e3::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Thu, 1 Oct 2026 22:00:47 +0000

from BN2PEPF0000A802.namprd02.prod.outlook.com (2603:10b6:408:10d:cafe::40) by BN9PR03CA0573.outlook.office365.com (2603:10b6:408:10d::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Thu, 1 Oct 2026 22:00:47 +0000

from [89.213.118.158] (89.213.118.158) by BN2PEPF0000A802.mail.protection.outlook.com (10.167.245.171) with Microsoft SMTP Server id 15.21.472.14 via Frontend Transport; Thu, 1 Oct 2026 22:00:46 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning weinmaninsurance.com discourages use of 89.213.118.158 as permitted sender)

Message-Id

<0561b670-f24e-4c7e-8768-b7f2b6507164@BN2PEPF0000A802.namprd02.prod.outlook.com>

Extracted URLs

  • file https://login.microsoft.com/common/oauth2/v2.0/authorize?state=dfD&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=334964ec-e61c-4821-94b4-37c42ee46504&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==

  • file https://na4.documents.adobe.com/public/

  • file https://www.adobe.com/go/terms