Overview

overview

7

Static

static

1

reported_email.eml

windows10-2004-x64

7

reported_email.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    reported_email.eml
  • Size 72KB
  • Sample261023-nd531scf94
  • SHA256 3dcb0505f3cc7bba8d62410abe6e4b1b702d3a6b9e6c8a19689044dfde87dc70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • reported_email.eml
    .eml 72KB
  • email-html-2.txt
    .html 34KB
  • email-plain-1.txt
    7KB

reported_email.eml

  • SHA256 3dcb0505f3cc7bba8d62410abe6e4b1b702d3a6b9e6c8a19689044dfde87dc70
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Tue, 20 Oct 2026 09:45:11 +0000

Subject

=?utf-8?B?V2FzIHVucyBhbnRyZWlidDogRm9yc2NodW5nLCBVbnRlcnN0w7x0enVuZyAm?= =?utf-8?B?IG5ldWUgSWRlZW4g8J+SmQ==?=

Content-Type

multipart/alternative; boundary="_000_qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94pkitmail3com_"

Received

from GV2PR03MB428634.eurprd03.prod.outlook.com (2603:10a6:150:37d::19) by AM4PR03MB11053.eurprd03.prod.outlook.com with HTTPS; Tue, 20 Oct 2026 09:45:15 +0000

from LO4P123CA0078.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:190::11) by GV2PR03MB428634.eurprd03.prod.outlook.com (2603:10a6:150:37d::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.19; Tue, 20 Oct 2026 09:45:14 +0000

from CPH1EPF0000052F.eurprd05.prod.outlook.com (2603:10a6:600:190:cafe::7a) by LO4P123CA0078.outlook.office365.com (2603:10a6:600:190::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 09:45:13 +0000

from esa.hc1191-61.eu.iphmx.com (23.90.122.49) by CPH1EPF0000052F.mail.protection.outlook.com (10.167.241.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 09:45:13 +0000

from o38.ck.n.convertkit.com ([149.72.39.237]) by esa4.hc1191-61.eu.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Oct 2026 02:45:12 -0700

by recvd-b4fff8755-djfjg with SMTP id recvd-b4fff8755-djfjg-1-6AD73826-D7 2026-10-20 09:45:10.811572545 +0000 UTC m=+1788250.884740289

from NTI2ODgxNzY (unknown) by geopod-ismtpd-72 (SG) with HTTP id u6g_X9jpRaOfFfcmvcKDxQ Tue, 20 Oct 2026 09:45:10.794 +0000 (UTC)

Received-Spf

Pass (esa.hc1191-61.eu.iphmx.com: domain of [email protected] designates 149.72.39.237 as permitted sender) identity=helo; client-ip=149.72.39.237; receiver=esa.hc1191-61.eu.iphmx.com; envelope-from="bounces+52688176-7b93-barbara.guentensperger=mt.com@ckespa.shane-osteosarcoma.ch"; x-sender="[email protected]"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/18 ip4:159.26.176.0/20 include:ab.sendgrid.net ~all"

Message-Id

<[email protected]>

Extracted URLs

  • file https://217a4248.click.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p/58hvh7hgwovezlu6h4/aHR0cHM6Ly9zaG9wLnNoYW5lLW9zdGVvc2FyY29tYS5jaC8=

  • file https://217a4248.click.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p/dpheh0hexw437kimh4/aHR0cHM6Ly9idWlsdHdpdGgua2l0LW1haWwzLmNvbT91dG1fY2FtcGFpZ249cG93ZXJlZGJ5JnV0bV9jb250ZW50PWVtYWlsJnV0bV9tZWRpdW09cmVmZXJyYWwmdXRtX3NvdXJjZT1keW5hbWlj

  • file https://217a4248.click.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p/n2hohvhv458dk9b6hg/aHR0cHM6Ly9zaGFuZS1vc3Rlb3NhcmNvbWEuY2gvZGUvZWlnZW5lLXNwZW5kZW5ha3Rpb24tc3RhcnRlbi8=

  • file https://217a4248.click.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p/owhkhqhwelkz78uvhr/aHR0cHM6Ly9jY3JpLmF0L3N0LWFubmEtY2NyaS1ob3N0cy0yMDI2LWZvc3Rlci1tZWV0aW5nLw==

  • file https://217a4248.click.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p/vqh3hrho63x5k2hghl/aHR0cHM6Ly9zaGFuZS1vc3Rlb3NhcmNvbWEuY2gv

  • file https://217a4248.open.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p]

  • file https://217a4248.unsubscribe.kit-mail3.com/qdu2gp7w62u7h4x5w8vtlh8836kppf4h8r94p

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://embed.filekitcdn.com/e/cwRr1Cz5jtY29VsvVMdzn6/8YBtbkdq1E9Vmo7WxeehNj/email]

  • Show all