Overview

overview

7

Static

static

1

c3aaea26-e...b7.eml

windows10-2004-x64

7

c3aaea26-e...b7.eml

windows11-ltsc_2024-x64

1

Resubmissions

02/10/2026, 17:57

261002-wjvs8stekg7

02/10/2026, 17:52

261002-wf2sdatbpf7

02/10/2026, 17:47

261002-wdb4yavw9r7

Sharing

Copy URL Twitter E-mail

General

  • Target
    c3aaea26-ed6e-30ca-dcc2-4e13bfd4efb7.eml
  • Size 2.3MB
  • Sample261002-wf2sdatbpf
  • SHA256 11278e0f13c0d60d5628fb53f547b91abeb181a9021c20e21cef08fb3e389ac6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • c3aaea26-ed6e-30ca-dcc2-4e13bfd4efb7.eml
    .eml 2.3MB
  • Bass_ee6eb2de-5fdb-4409-9439-39b7eaa06926.png
    .png 12KB
  • agencyportal-smallerresizedv1_4dcb273c-d17c-400e-9113-3d67274162b7.png
    .png 35KB
  • email-html-2.txt
    .html 107KB
  • email-plain-1.txt
    13KB
  • image001.png
    .png 276KB
  • image002.png
    .png 12KB
  • image003.png
    .png 35KB
  • image004.png
    .png 76B
  • image005.png
    .png 156KB
  • image006.gif
    .gif 680KB
  • image007.gif
    .gif 82KB
  • image008.png
    .png 147KB
  • image009.png
    .png 42KB
  • image010.png
    .png 32KB
  • image011.png
    .png 35KB
  • image012.png
    .png 33KB

c3aaea26-ed6e-30ca-dcc2-4e13bfd4efb7.eml

  • SHA256 11278e0f13c0d60d5628fb53f547b91abeb181a9021c20e21cef08fb3e389ac6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

[email protected]

Date

Wed, 30 Sep 2026 18:14:52 +0000

Subject

Bass Underwriters

Content-Type

multipart/related; boundary="_017_CD9D20F135C149F48F29AFDC53115BA4bassuwcom_"; type="multipart/alternative"

Received

from IA2PR20MB7346.namprd20.prod.outlook.com (::1) by PH7PR20MB7165.namprd20.prod.outlook.com with HTTPS; Wed, 30 Sep 2026 18:15:55 +0000

from SJ0P220CA0010.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:41b::14) by IA2PR20MB7346.namprd20.prod.outlook.com (2603:10b6:208:4ac::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.16; Wed, 30 Sep 2026 18:15:45 +0000

from CO1PEPF00012E82.namprd03.prod.outlook.com (2603:10b6:a03:41b:cafe::85) by SJ0P220CA0010.outlook.office365.com (2603:10b6:a03:41b::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Wed, 30 Sep 2026 18:15:45 +0000

from CH4PR04CU002.outbound.protection.outlook.com (2a01:111:f403:c105::7) by CO1PEPF00012E82.mail.protection.outlook.com (2603:10b6:30f:fff5::449) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 18:15:42 +0000

from BN9PR03CA0378.namprd03.prod.outlook.com (2603:10b6:408:f7::23) by PH7PR16MB6074.namprd16.prod.outlook.com (2603:10b6:510:307::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Wed, 30 Sep 2026 18:15:09 +0000

from BN7PEPF0000009D.namprd04.prod.outlook.com (2603:10b6:408:f7:cafe::74) by BN9PR03CA0378.outlook.office365.com (2603:10b6:408:f7::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 18:15:08 +0000

from us1-emailsignatures-cloud.codetwo.com (20.98.2.159) by BN7PEPF0000009D.mail.protection.outlook.com (10.167.248.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 18:15:04 +0000

from DM2PR0701CU001.outbound.protection.outlook.com (40.93.13.64) by us1-emailsignatures-cloud.codetwo.com with CodeTwo SMTP Server (TLS12) via SMTP; Wed, 30 Sep 2026 18:15:01 +0000

from BN6PR16MB3041.namprd16.prod.outlook.com (2603:10b6:405:7a::35) by SACPR16MB895501.namprd16.prod.outlook.com (2603:10b6:806:542::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.16; Wed, 30 Sep 2026 18:14:53 +0000

from BN6PR16MB3041.namprd16.prod.outlook.com ([fe80::6a5f:7238:39b8:7989]) by BN6PR16MB3041.namprd16.prod.outlook.com ([fe80::6a5f:7238:39b8:7989%7]) with mapi id 15.21.0472.015; Wed, 30 Sep 2026 18:14:53 +0000

Received-Spf

Pass (protection.outlook.com: domain of bassuw.com designates 20.98.2.159 as permitted sender) receiver=protection.outlook.com; client-ip=20.98.2.159; helo=us1-emailsignatures-cloud.codetwo.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://nam12.safelinks.protection.outlook.com/?url=

  • file https://primroseleesburgps-my.sharepoint.com/:f:/g/personal/administration_rainbowssvc_com/IgBTKObk0yosQpvtQcovYojFAailiGVbqY2L6h2BNd7FXKk?e=nd0pkA&xsdata=MDV8MDJ8c2hvbmcxQGZhcm1lcnNhZ2VudC5jb218ZTNkMjNjOGFjOGRmNDhiOTYzNDQwOGRmMWYxZWQ4N2Z8ZGIzMzY3YjczNzgyNDMxYWJmYzg0YzBhNTU4N2Y3MTZ8MHwwfDYzOTI2Mzg4OTU2ODE2MjQwM3xVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18MHx8fA%3d%3d&sdata=UTJNY1QwdFNrT0V1T0Zwc0pYZElsbFMwV0M0L2krSTdXZXc2YkpmSGh0WT0%3d

  • file https://quote.bassuw.com/

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_0

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_1

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_10

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_11

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_12

  • file https://trk.hi.lucentglobe.com/l/01M25057SY79GNRDNXJMZJT0C0_13

  • Show all