Overview

overview

1

Static

static

1

=utf-8qSMA...P=.eml

windows10-2004-x64

1

=utf-8qSMA...P=.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    =utf-8qSMARepsoLabySedes_-_NOTIFICACI=C3=93N_PT=3A_CAMBIO_DE_ESTADO_DEL_P=.eml
  • Size 21KB
  • Sample261027-hfd5es11d1
  • SHA256 609fbec7e772b79d80d76e613420be94a17544838cacf7ed522225e938c7c6e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • =utf-8qSMARepsoLabySedes_-_NOTIFICACI=C3=93N_PT=3A_CAMBIO_DE_ESTADO_DEL_P=.eml
    .eml 21KB
  • email-plain-1.txt
    1KB

=utf-8qSMARepsoLabySedes_-_NOTIFICACI=C3=93N_PT=3A_CAMBIO_DE_ESTADO_DEL_P=.eml

  • SHA256 609fbec7e772b79d80d76e613420be94a17544838cacf7ed522225e938c7c6e7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 21 Oct 2026 15:20:04 -0000

Subject

=?utf-8?q?SMARepsoLabySedes_-_NOTIFICACI=C3=93N_PT=3A_CAMBIO_DE_ESTADO_DEL_P?= =?utf-8?q?ERMISO_DE_TRABAJO_EN_EL_QUE_EST=C3=81_DESIGNADO_COMO_EJECUTANTE?=

Content-Type

text/plain; charset="utf-8"

Received

from DU4PR03MB10923.eurprd03.prod.outlook.com (2603:10a6:10:591::15) by AS8PR03MB7602.eurprd03.prod.outlook.com with HTTPS; Wed, 21 Oct 2026 15:21:09 +0000

from AS4P191CA0038.EURP191.PROD.OUTLOOK.COM (2603:10a6:20b:657::7) by DU4PR03MB10923.eurprd03.prod.outlook.com (2603:10a6:10:591::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Wed, 21 Oct 2026 15:20:06 +0000

from CPH1EPF0000052F.eurprd05.prod.outlook.com (2603:10a6:20b:657:cafe::22) by AS4P191CA0038.outlook.office365.com (2603:10a6:20b:657::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Wed, 21 Oct 2026 15:20:06 +0000

from esa.hc1191-61.eu.iphmx.com (23.90.104.25) by CPH1EPF0000052F.mail.protection.outlook.com (10.167.241.170) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Wed, 21 Oct 2026 15:20:06 +0000

from llsc199-a17.servidoresdns.net ([82.223.190.46]) by esa1.hc1191-61.eu.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Oct 2026 08:20:05 -0700

from a45196f6070a (unknown [212.227.40.1]) by llsc199-a17.servidoresdns.net (Postfix) with ESMTPA id 4j8tJ5063xz3hnxV; Wed, 21 Oct 2026 17:20:04 +0200 (CEST)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning beresoft.com discourages use of 23.90.104.25 as permitted sender)

None (esa.hc1191-61.eu.iphmx.com: no sender authenticity information available from domain of [email protected]) identity=pra; client-ip=82.223.190.46; receiver=esa.hc1191-61.eu.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible

Pass (esa.hc1191-61.eu.iphmx.com: domain of [email protected] designates 82.223.190.46 as permitted sender) identity=mailfrom; client-ip=82.223.190.46; receiver=esa.hc1191-61.eu.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:82.223.85.0/24 ip4:82.223.190.0/23 ip4:82.223.199.0/24 ip4:82.223.218.0/23 ip4:82.223.230.0/24 ip4:82.223.251.0/24 ip4:217.76.128.0/23 ip4:217.76.150.128/25 ip4:217.76.156.128/25 ~all"

None (esa.hc1191-61.eu.iphmx.com: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=82.223.190.46; receiver=esa.hc1191-61.eu.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible

Message-Id

<179259600483.14760.4368686684710177425@a45196f6070a>

Extracted URLs

  • file https://aka.ms/LearnAboutSend=

  • file https://eur01.safelinks.protection.outlook.com/?url=3D