QuarantineMessage (1).zip
- SHA256 37074acdf041552abcc4017385bd83159d0dd99f0f7629eebd6595e058a846b8
Password
1
Static task
static1
Behavioral task
behavioral1
Sample
email-html-2.html
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target QuarantineMessage (1).zip
- Size 20KB
- Sample261014-hay8eahv5m
- SHA256 37074acdf041552abcc4017385bd83159d0dd99f0f7629eebd6595e058a846b8
- MD5 8d0f9177afecfefaf91a131d6f9f3fa7
- SHA1 a069d92ce598810ea2f0e04643d3162eafc67e91
- SHA512 7424455d79869630e8fd47cabd0fba8d935afb70456d1d56c969df09216f697cd29c480d1d0a098d04b6a8882c3746e125fc0f00e7ba6b1038d630f3c2d8fe17
- SSDEEP 384:/FmBiCJNMuSzxyx55obIGZqkneishBo4tuFnN7klMV9qRgDjNV+kFX7ZrE66:NmtNMXzq55LG0k+ewI37L+kFXtc
- TLSH T191A2D090B30AABEBE9A54EF56F3D85F24D4C60A1510D523E62FCBB66E8B0597430306C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
QuarantineMessage (1).zip.zip 20KB
-
8cf54c0b-3651-447c-5414-08df28466de7/511780fc-54f5-8d23-73f9-0460b59fa741.eml.eml 72KB
-
attachment-3.eml 40KB
-
email-html-2.txt24KB
-
email-plain-1.txt3KB
-
email-html-2.txt.html 16KB
-
email-plain-1.txt931B
8cf54c0b-3651-447c-5414-08df28466de7/511780fc-54f5-8d23-73f9-0460b59fa741.eml
- SHA256 360e5100e731f227ae48b972d6ba3975f9546b0d3e1ed82c86c1447ddbde50c3
- MD5 74487e0f0a1aea8303f1b69663508a36
- SHA1 a2fac6291f00d5c6d9a8f8f4fdbfde05c4488762
- SHA512 bdc6c4d0356c40ef352ae8372bcedfed69ff94fe3b05146a261ca7f01c842129a484071afc4730f64812e232e95601c16ad3d440bbce0bda649e26b9005135b8
- SSDEEP 1536:gbOfTL1UpCBDFs6238Ddjgz61To//GKLlRNbPm7m747s3uYAVkRhPoiXfBoz61Tu:gbOLLupCVtNOxDC
- TLSH T13E732C07F3C02C458D6B09656543777CBF7958CA9F2648B0A1EF6F7E1B4EC939286248
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1
Email Headers
From
Return-Path
Date
Mon, 12 Oct 2026 09:51:41 +0000
Subject
Drawings Gasunie underground compressor station Alphen
Content-Type
multipart/mixed; boundary="_004_DB9PR02MB7449FE73E03716BACCCDCF21859F2DB9PR02MB7449eurp_"
Received
from GV2PR10MB720501.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:38c::23) by DU0PR10MB6677.EURPRD10.PROD.OUTLOOK.COM with HTTPS; Mon, 12 Oct 2026 09:51:50 +0000
from AM0P309CA0013.EURP309.PROD.OUTLOOK.COM (2603:10a6:20b:28f::34) by GV2PR10MB720501.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:38c::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.20; Mon, 12 Oct 2026 09:51:46 +0000
from AMS0EPF00000566.eurprd02.prod.outlook.com (2603:10a6:20b:28f:cafe::18) by AM0P309CA0013.outlook.office365.com (2603:10a6:20b:28f::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.2 via Frontend Transport; Mon, 12 Oct 2026 09:51:46 +0000
from mail04.dictu.nl (145.69.216.26) by AMS0EPF00000566.mail.protection.outlook.com (10.167.242.116) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Mon, 12 Oct 2026 09:51:46 +0000
Received-Spf
Pass (protection.outlook.com: domain of rvo.nl designates 145.69.216.26 as permitted sender) receiver=protection.outlook.com; client-ip=145.69.216.26; helo=mail04.dictu.nl; pr=C
Message-Id
<DB9PR02MB7449FE73E03716BACCCDCF21859F2@DB9PR02MB7449.eurprd02.prod.outlook.com>
Extracted URLs
-
file http://www.rvo.nl/
-
file https://aka.ms/LearnAboutSenderIdentification
attachment-3
- SHA256 e7fe75b634df162ebb0a1c7d9b438145874f3a14e426c2ee2331dd7293629c44
- MD5 93ea698176cd34ba1a9144105d95e41f
- SHA1 90bdff929a3d605337dd7abffe72c7173f22c10e
- SHA512 7d03636b4aff123d9422f530e1968e256f04b1965b5ca1d3f20e3dfa5ebfd060d503f6572895a16b7b0ac6511bc3b6b531ade1d4472a1cf8b63500ec3127ae9a
- SSDEEP 768:IuIlRhRp3b73Z8bLxuIxrWNPm7m747s3uYAVkRhPoiXfBoz61To/BVEK4Z+oISq3:klRNbPm7m747s3uYAVkRhPoiXfBoz61q
- TLSH T1D7135F07A3C11C898D7B08256153777CBB7858CA5F664DB0B1EF6F3A1B4DC83A6D6288
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1
Email Headers
From
Reply-To
Date
Fri, 9 Oct 2026 12:29:28 +0000
Subject
Drawings CS-Alphen
Content-Type
multipart/alternative; boundary="_000_010101a120a3cff9a4ee2a4cb51e4a5f9a791875bfe0292e000000u_"
Received
from AM9PR02MB6787.eurprd02.prod.outlook.com (2603:10a6:20b:2c8::12) by DB9PR02MB7449.eurprd02.prod.outlook.com with HTTPS; Fri, 9 Oct 2026 12:29:37 +0000
from DUZPR01CA0041.eurprd01.prod.exchangelabs.com (2603:10a6:10:468::19) by AM9PR02MB6787.eurprd02.prod.outlook.com (2603:10a6:20b:2c8::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.19; Fri, 9 Oct 2026 12:29:33 +0000
from DU2PEPF00028D09.eurprd03.prod.outlook.com (2603:10a6:10:468:cafe::a1) by DUZPR01CA0041.outlook.office365.com (2603:10a6:10:468::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Fri, 9 Oct 2026 12:29:33 +0000
from edge.cloud-wp.nl (145.12.220.242) by DU2PEPF00028D09.mail.protection.outlook.com (10.167.242.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Fri, 9 Oct 2026 12:29:33 +0000
from W1122P1011.cicwp.nl (10.106.91.181) by edge.cloud-wp.nl (10.106.78.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53; Fri, 9 Oct 2026 14:29:32 +0200
from W1122P1011.cicwp.nl (10.106.91.181) by W1122P1011.cicwp.nl (10.106.91.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53; Fri, 9 Oct 2026 14:29:32 +0200
from panter22d-relay.cicapp.nl (10.87.67.219) by W1122P1011.cicwp.nl (10.106.91.181) with Microsoft SMTP Server id 15.2.2562.53 via Frontend Transport; Fri, 9 Oct 2026 14:29:32 +0200
from panter011d-relay.ciman.nl ([10.81.16.18]) by panter22d-public.cicapp.nl with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 09 Oct 2026 14:29:33 +0200
from a84-14.smtp-out.us-west-2.amazonses.com ([54.240.84.14]) by mail04.dictu.nl with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 09 Oct 2026 14:29:31 +0200
Received-Spf
None (mail04.dictu.nl: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=54.240.84.14; receiver=mail04.dictu.nl; envelope-from="010101a120a3cff9-a4ee2a4c-b51e-4a5f-9a79-1875bfe0292e-000000@spaces.hightail.com"; x-sender="[email protected]"; x-conformance=spf_only
Message-Id
<010101a120a3cff9-a4ee2a4c-b51e-4a5f-9a79-1875bfe0292e-000000@us-west-2.amazonses.com>
Extracted URLs
-
file http://spaces.hightail.com/signup
-
file https://aka.ms/LearnAboutSenderIdentification
-
file https://eur01.safelinks.protection.outlook.com/?url=
-
file https://hightailspaces.com/
-
file https://spaces.hightail.com/receive/3Y70HlSMAf/bWlrZS52YW5sZWV1d2VuQHJ2by5ubA==
-
file https://www.hightail.com/terms
-
file https://www.opentext.com/about/copyright-information/site-privacy
email-html-2.txt
- SHA256 5f6a50345000a1b833b53ff690b53cdf9bad3eaa259fa2a5f7bd442c99bbd9ce
- MD5 1f6e90b02205bdb0138c7111fb72a536
- SHA1 a6e25c06feef9519188387d1cd997a36ebbf4f6b
- SHA512 867eabf66c3a95acbe72d0d8747c76d715e40b7c34bb97ccaeb475e523a2f5931f47a34e3e02a696fff609c0427e6d9150d1841fd519bafad44d25f71aaf98e7
- SSDEEP 768:m7H7+7C7u7wra+SjavNj8I9LlU7BmOTc1twTFZUs1nKWTc:m7H7+7C7u7wra+SjavNj8I9LlU7BmOTi
- TLSH T149B22E13E3C02C59892B4825A153677CBB7990C69F654DB0B5EF3B3E1B4DC9392E2288
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 d08e904257c6ba33006e9f843d2be0909ddafef0a29c8fd10b85ea6e0c08ba59
- MD5 685e000779469e4034972fc4aa6c54c0
- SHA1 fbbe3b29f525e09821e0796faa731089fc15290d
- SHA512 30efa43282ab36141d28559dc954fd76650c2b0d38f138d0eec5e540c4df9360a9d70c84546d6e0b741963a58b3f3b1e69dd62be0fb56217cdf98b6c514cca2a
- TLSH T15561318DB347284F1B9524ABB255860CE1A1649E7BF8BEB5F2EC870033471233652DDE
- MD5 SHA1 SHA512 TLSH
email-html-2.txt
- SHA256 5019ba5cdf4a66d0e4e397d249694b93566e5017a56ac839d1f9b8bead96b9e2
- MD5 c5ed7e51331b845050b4436ca3398faa
- SHA1 075bc75b50135228caf54064dbfd53d48f6ff048
- SHA512 fd7ae0361764437905f9d26370440c10bc61fce8cac56d7da401b441f69dbe97afd41cea2da83fa754d5de65f40e9ae5c2687810d14d4aa629e23320bf481176
- SSDEEP 384:93RHbM7BmOTcQSwTKErQZArwJPQPaPBNmV9O:ro7BmOTcQSwT6D
- TLSH T1EE723E07F7C02901D9AF4DA0A157377D7F798ADA8B220DB4A5DA2B7D1B4DCE382C1249
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 706e7372fb849fae88faddc5cf1196ed2d584a0023e92cc9167492c114b6ccad
- MD5 504c2aea2f37cd36d189a562dbe848f3
- SHA1 4f1eef41f93bd07c129b3aa38f7f7ccf64b7cc05
- SHA512 f00b4e600850923caf8ab13d2458887140329bb56bc5f01cd4d86c43e98962ebea3e25dc9022811648779fabba88c612fef5988b0db40d09168044a0f454ade4
- TLSH T1A311BDCF25487619A07680A6FD2DABD1FE470C6A5F4971B45B604A3F344243C217B5DE
- MD5 SHA1 SHA512 TLSH