General

  • Target
    FW_ CANTRIO.eml
  • Size 295KB
  • Sample261020-2pbkfaaz3k
  • SHA256 442e55d2e9a4bb17cea56ea63786dda55950f6d2dcc37c616c675412b753fa2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • FW_ CANTRIO.eml
    .eml 295KB
  • cantrio_logo_black_new.webp
    556B
  • email-html-2.txt
    .html 11KB
  • email-plain-1.txt
    2KB
  • image001.png
    .png 191KB

FW_ CANTRIO.eml

  • SHA256 442e55d2e9a4bb17cea56ea63786dda55950f6d2dcc37c616c675412b753fa2d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

SJ2PR16MB5871A08346849D5B0844D661B6672@SJ2PR16MB5871.namprd16.prod.outlook.com

Return-Path

[email protected]

Date

Tue, 20 Oct 2026 20:09:54 +0000

Subject

=?iso-8859-1?Q?FW:_CANTRIO_x=A0Yavapai_Mechanical?=

Content-Type

multipart/mixed; boundary="_006_BLAPR05MB720388CFA73868E6AD8D89A4DA672BLAPR05MB7203namp_"

Received

from DS2PR22MB486798.namprd22.prod.outlook.com (2603:10b6:8:3c3::8) by CY4PR2201MB1112.namprd22.prod.outlook.com with HTTPS; Tue, 20 Oct 2026 20:10:07 +0000

from SJ0PR03CA0166.namprd03.prod.outlook.com (2603:10b6:a03:338::21) by DS2PR22MB486798.namprd22.prod.outlook.com (2603:10b6:8:3c3::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Tue, 20 Oct 2026 20:10:02 +0000

from SJ1PEPF00002320.namprd03.prod.outlook.com (2603:10b6:a03:338:cafe::5c) by SJ0PR03CA0166.outlook.office365.com (2603:10b6:a03:338::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Tue, 20 Oct 2026 20:10:02 +0000

from BN1PR04CU002.outbound.protection.outlook.com (2a01:111:f403:c110::1) by SJ1PEPF00002320.mail.protection.outlook.com (2603:10b6:a0f:fc02::156) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 20:10:01 +0000

from BLAPR05MB7203.namprd05.prod.outlook.com (2603:10b6:208:29a::9) by MWHPR05MB10815.namprd05.prod.outlook.com (2603:10b6:303:282::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.19; Tue, 20 Oct 2026 20:09:54 +0000

from BLAPR05MB7203.namprd05.prod.outlook.com ([fe80::6669:ec55:1831:edfb]) by BLAPR05MB7203.namprd05.prod.outlook.com ([fe80::6669:ec55:1831:edfb%5]) with mapi id 15.21.0522.016; Tue, 20 Oct 2026 20:09:54 +0000

Received-Spf

Pass (protection.outlook.com: domain of yavmech.com designates 2a01:111:f403:c110::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c110::1; helo=BN1PR04CU002.outbound.protection.outlook.com; pr=C

Message-Id

<BLAPR05MB720388CFA73868E6AD8D89A4DA672@BLAPR05MB7203.namprd05.prod.outlook.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://d5qhrh04.na1.hs-sales-engage.com/Ctc/JA+23284/d5qhRh04/JkM2-6qcW6N1vHY6lZ3mHN24vtvW9BMZYW465C178NFgqyVS3mkF3dwmGnN631kMBVLN5tM3klkWtQ648W5JXtSb4wP3-NW4wsLvy5dBfLBW37BVxY1g3Kh6M29Wdm930FYW6p3FfP8crBj1W2dwDn41sV9V3W46X9362DbCxDW3RJzCv33VgzXW1r4S-b8037ckW4KLTz-1HdYJ2W1Qmq7D299xcYW61qhwy6CPB76W3WWDbz2y86vqW4lprSn68R7V7W17yJFL5l_ZbcV4sg4f5c4mmdW6gcR1x7q3-0bf3N0y4H04

  • file https://d5qhrh04.na1.hs-sales-engage.com/Ctc/JA+23284/d5qhRh04/Jks2-6qcW69sMD-6lZ3pyN7W1LWcs406mW6YTGRh8HwPBjW42tdg227FqsJW67WJf76-5zBjVMwf124cFQstVS8hqK103gjvW6Vczc47X2x_KW3Wx8kV47g-TFW6CKKKK5bS1dyW8gXPsJ3qzBbNW20jc-Y59W0q8W1l8j0K5h4BC_W49lW2-8NV5KwW47kVh611Pj3lW5T-h5X1Z6C1qV3gGHQ5fqWyzW3_lr3b1FD_bSV62_dQ2B4nHBVSLkVh52fwwGVm7B_w54mK4rf1tkSJq04