Resubmissions

27/10/2026, 02:05

261027-ch8txsax9q1

27/10/2026, 02:02

261027-cghw4sz1ew1

General

  • Target
    -3596139128519525556.eml
  • Size 23.6MB
  • Sample261027-ch8txsax9q
  • SHA256 ef126ccb5e3df00583ee5d73cd8754dd1c9c7f6c647e87f09866b3be8f11392a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • -3596139128519525556.eml
    .eml 23.6MB
  • 26_10_KCJH3_55067.bmp
    17.2MB
  • email-html-2.txt
    .html 766B
  • email-plain-1.txt
    386B

-3596139128519525556.eml

  • SHA256 ef126ccb5e3df00583ee5d73cd8754dd1c9c7f6c647e87f09866b3be8f11392a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 26 Oct 2026 11:33:01 -0400

Subject

[External] Our product list is checked and ready for you.

Content-Type

multipart/related; boundary="000000000000b6ebb5065ec00bf4"

Received

from MWHPR03MB989356.namprd03.prod.outlook.com (::1) by CH0PR03MB6162.namprd03.prod.outlook.com with HTTPS; Mon, 26 Oct 2026 15:33:28 +0000

from CH5P222CA0009.NAMP222.PROD.OUTLOOK.COM (2603:10b6:610:1ee::25) by MWHPR03MB989356.namprd03.prod.outlook.com (2603:10b6:303:29d::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 15:33:10 +0000

from DM3PEPF000265AF.namprd02.prod.outlook.com (2603:10b6:610:1ee:cafe::6a) by CH5P222CA0009.outlook.office365.com (2603:10b6:610:1ee::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 15:33:09 +0000

from ord3appcp001.assurant.com (167.79.14.192) by DM3PEPF000265AF.mail.protection.outlook.com (10.167.23.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 15:33:09 +0000

from pps.filterd (ord3appcp001.assurant.com [127.0.0.1]) by ord3appcp001.assurant.com (8.18.1.11/8.18.1.11) with ESMTP id 69QFSqgM304514 for <[email protected]>; Mon, 26 Oct 2026 11:33:08 -0400

from mail-yw1-f172.google.com (mail-yw1-f172.google.com [209.85.128.172]) by ord3appcp001.assurant.com (PPS) with ESMTPS id 4hj9hug1f8-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Mon, 26 Oct 2026 11:33:05 -0400 (EDT)

by mail-yw1-f172.google.com with SMTP id 00721157ae682-8b0d126f631so26271757b3.2 for <[email protected]>; Mon, 26 Oct 2026 08:33:05 -0700 (PDT)

from 240013897783 named unknown by gmailapi.google.com with HTTPREST; Mon, 26 Oct 2026 11:33:01 -0400

from 240013897783 named unknown by gmailapi.google.com with HTTPREST; Mon, 26 Oct 2026 11:33:01 -0400

X-Received

by 2002:a05:690c:3141:b0:8b0:a01e:2ccd with SMTP id 00721157ae682-8b166c938afmr40677627b3.62.1793028783326; Mon, 26 Oct 2026 08:33:03 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 167.79.14.192 as permitted sender)

Message-Id

<CAH6=31W-id9ucEfVHdCDdx7m6zcSGM4GE7tsdm=b2dpJhhkkwg@mail.gmail.com>