General

  • Target
    BASF OAA-26-031 AWAS Replacement Neue Nachricht erhalten.eml
  • Size 44KB
  • Sample261027-jkq58astft
  • SHA256 c5ca137928a0e62c08a2904988310466dcda33a650daa269b0cbfe82409ad57e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • BASF OAA-26-031 AWAS Replacement Neue Nachricht erhalten.eml
    .eml 44KB
  • email-html-2.txt
    .html 27KB
  • email-plain-1.txt
    3KB

BASF OAA-26-031 AWAS Replacement Neue Nachricht erhalten.eml

  • SHA256 c5ca137928a0e62c08a2904988310466dcda33a650daa269b0cbfe82409ad57e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Wed, 21 Oct 2026 14:57:56 +0000

Subject

BASF | OAA-26-031 AWAS Replacement: Neue Nachricht erhalten

Content-Type

multipart/alternative; boundary="_000_TIMwkoASAiTuiBWDW5ZCQgeopodismtpd15_"

Received

from AS8PR03MB9770.eurprd03.prod.outlook.com (2603:10a6:20b:61d::10) by AM0PR03MB5553.eurprd03.prod.outlook.com with HTTPS; Wed, 21 Oct 2026 14:58:00 +0000

from DU6P191CA0022.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:540::13) by AS8PR03MB9770.eurprd03.prod.outlook.com (2603:10a6:20b:61d::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Wed, 21 Oct 2026 14:57:58 +0000

from DU2PEPF00028D13.eurprd03.prod.outlook.com (2603:10a6:10:540:cafe::90) by DU6P191CA0022.outlook.office365.com (2603:10a6:10:540::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Wed, 21 Oct 2026 14:57:58 +0000

from esa.hc1191-61.eu.iphmx.com (23.90.122.49) by DU2PEPF00028D13.mail.protection.outlook.com (10.167.242.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Wed, 21 Oct 2026 14:57:58 +0000

from o2.ptr5132.mercanis.net ([168.245.19.110]) by esa3.hc1191-61.eu.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Oct 2026 07:58:03 -0700

by recvd-76479b6d66-r9f8s with SMTP id recvd-76479b6d66-r9f8s-1-6AD8D2F4-41 2026-10-21 14:57:56.596392159 +0000 UTC m=+1893467.523234308

from MjAyOTg1NzQ (unknown) by geopod-ismtpd-15 (SG) with HTTP id TIMwk_oASAiTuiBWDW5ZCQ Wed, 21 Oct 2026 14:57:56.547 +0000 (UTC)

Received-Spf

None (esa.hc1191-61.eu.iphmx.com: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=168.245.19.110; receiver=esa.hc1191-61.eu.iphmx.com; envelope-from="bounces+[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible

Message-Id

<TIMwk_oASAiTuiBWDW5ZCQ@geopod-ismtpd-15>

Extracted URLs

  • file http://www.ariba.com/legal/ariba_data_policy.cfm

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://eur01.safelinks.protection.outlook.com/?url=

  • file https://sup.mercanis.io/events/d4cd73db-b4b6-4e91-bb5d-fdff366c0eac?conversation_id=b6995d10-fcd3-4b90-b6d5-e8aa66738927&twilio_sid=CHb4565cb339924468a73cbf7be6d9b77b

  • file https://www.ariba.com/offices

  • file https://www.mercanis.com/

  • file https://www.mercanis.com/data-processing-agreement