Overview

overview

8

Static

static

1

Message.eml

windows10-2004-x64

1

Message.eml

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 166KB
  • Sample261014-m74llstwdv
  • SHA256 873ff26662e7eb14fd586634b35768e01584ea550cb83ad8780971d4b78e6e52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 166KB
  • email-html-2.txt
    .html 92KB
  • email-plain-1.txt
    10KB

Message.eml

  • SHA256 873ff26662e7eb14fd586634b35768e01584ea550cb83ad8780971d4b78e6e52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

Return-Path

[email protected]

Date

Wed, 14 Oct 2026 09:01:01 +0200 (CEST)

Subject

=?utf-8?q?=5BPossible_Phish_Fraud=5DNOA_-_Corporate_Actions_payment_confi?= =?utf-8?q?rmation_//_NOA_=E2=80=94_Confirmation_de_paiement_sur_les_op?= =?utf-8?q?=C3=A9rations_sur_titres?=

Content-Type

multipart/alternative; boundary="----=_Part_2888086_644738579.1791961261328"

Received

from SE2P216CA0183.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2ca::8) by TYZPR04MB8254.apcprd04.prod.outlook.com (2603:1096:405:e2::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Wed, 14 Oct 2026 07:55:01 +0000

from TY2PEPF0000AB86.apcprd03.prod.outlook.com (2603:1096:101:2ca:cafe::1a) by SE2P216CA0183.outlook.office365.com (2603:1096:101:2ca::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.4 via Frontend Transport; Wed, 14 Oct 2026 07:55:01 +0000

from esa2.hc847-16.ap.iphmx.com (139.138.44.82) by TY2PEPF0000AB86.mail.protection.outlook.com (10.167.253.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Wed, 14 Oct 2026 07:54:57 +0000

from aluminium-twzefi.ccmdcampaigns.net ([81.92.122.205]) by esa2.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Oct 2026 00:01:04 -0700

by aluminium-twzefi.ccmdcampaigns.net id hpskaq3cug8p for <[email protected]>; Wed, 14 Oct 2026 09:01:01 +0200 (envelope-from <[email protected]>)

by mta-hub0-instance0.server.actito.com id hpskaq3cug8p for <[email protected]>; Wed, 14 Oct 2026 09:01:01 +0200 (envelope-from <[email protected]>)

Received-Spf

Fail (protection.outlook.com: domain of securitiesservices.bnpparibas.com does not designate 139.138.44.82 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.44.82; helo=esa2.hc847-16.ap.iphmx.com;

Pass (esa2.hc847-16.ap.iphmx.com: domain of [email protected] designates 81.92.122.205 as permitted sender) identity=mailfrom; client-ip=81.92.122.205; receiver=esa2.hc847-16.ap.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:81.92.112.0/22 ip4:81.92.116.0/22 ip4:81.92.120.0/22 ip4:81.92.124.0/22 -all"

Message-Id

<1138584412.2888091.1791961261330@webapp-sender-noheavy0-instance1.server.actito.com>

Extracted URLs

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/Q2FwdHVyYSBkZSBlY3LDoyAyMDI2LTA5LTA0IDE0Mzg1My5wbmc=]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/Q2FwdHVyYSBkZSBlY3LDoyAyMDI2LTA5LTA0IDE0MzkzMi5wbmc=]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/Tk9BIDEucG5n]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/Tk9BIDIucG5n]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/UTJGd2RIVnlaU0JrNG9DWnc2bGpjbUZ1SURJd01qVXRNRFV0TVRZZ01UQTFOekUwTG5CdVp3PT0ucG5n]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/UTJGd2RIVnlaU0JrNG9DWnc2bGpjbUZ1SURJd01qVXRNRFV0TVRZZ01UQTFOekUwTG5CdVp3PT1fMC5wbmc=]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/aW1hZ2VfMTAucG5n]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/aW1hZ2VfMy5wbmc=]

  • file http://link.securitiesservices.bnpparibas.com/m/images/200358/511760/j9v9CMw-o-e6XHsxJPpSBl7-v4P6KX6D/aW1hZ2VfNC5wbmc=]

  • Show all