Resubmissions

23/10/2026, 15:13

261023-slzy7act2y1

23/10/2026, 15:12

261023-sljl7sct2v3

23/10/2026, 15:10

261023-skbj7scs9y1

General

  • Target
    7f915098-ca57-33c4-42f7-fa80efdeb44a.eml
  • Size 9.8MB
  • Sample261023-slzy7act2y
  • SHA256 4a2ddafbcbed8ce3eadf293947cc322459d8101bb79c463edc4315c0a13069ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 7f915098-ca57-33c4-42f7-fa80efdeb44a.eml
    .eml 9.8MB
  • Order Specs 22102026-0938.rar
    .rar 7.1MB
  • Order Specs 22102026-0938.vhdx
    68.0MB
  • email-html-2.txt
    .html 1KB
  • email-plain-1.txt
    1KB

7f915098-ca57-33c4-42f7-fa80efdeb44a.eml

  • SHA256 4a2ddafbcbed8ce3eadf293947cc322459d8101bb79c463edc4315c0a13069ec
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 22 Oct 2026 02:22:44 -0700

Subject

=?UTF-8?B?TmV3IFByb2R1Y3QgT3JkZXIgLSBBdHRhY2hlZCBGaWxl?=

Content-Type

multipart/mixed; boundary="===============5605305771057388085=="

Received

from PH7PR13CA0018.namprd13.prod.outlook.com (2603:10b6:510:174::22) by DS0PR20MB5930.namprd20.prod.outlook.com (2603:10b6:8:150::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Thu, 22 Oct 2026 09:23:52 +0000

from CY6PEPF00000049.namprd03.prod.outlook.com (2603:10b6:510:174:cafe::46) by PH7PR13CA0018.outlook.office365.com (2603:10b6:510:174::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.3 via Frontend Transport; Thu, 22 Oct 2026 09:23:51 +0000

from osnlsmtp01-10-t2.prod.phx3.secureserver.net (50.63.11.205) by CY6PEPF00000049.mail.protection.outlook.com (10.167.247.134) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Thu, 22 Oct 2026 09:23:51 +0000

from eloquent-mahavira.72-167-37-149.plesk.page ([72.167.37.149]) by : HOSTING RELAY : with ESMTPS id Jp0bx4xtdBfOLJp0bxHslf; Thu, 22 Oct 2026 09:22:49 +0000

from WIN-VI96OVQI4I6 (unknown [162.35.97.149]) by eloquent-mahavira.72-167-37-149.plesk.page (Postfix) with ESMTPSA id 7E6C2B8528 for <[email protected]>; Thu, 22 Oct 2026 09:22:46 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of na-golf.com designates 50.63.11.205 as permitted sender) receiver=protection.outlook.com; client-ip=50.63.11.205; helo=osnlsmtp01-10-t2.prod.phx3.secureserver.net; pr=C

pass (eloquent-mahavira.72-167-37-149.plesk.page: connection is authenticated)

X-Mailer

=?utf-8?b?VmlraW5nIE1haWxlciDimpTvuI8=?=

Message-Id

<179266096478.12152.17091530593012047394@WIN-VI96OVQI4I6>