Overview

overview

4

Static

static

1

lΡΚΟ Po...in.msg

windows10-2004-x64

4

lΡΚΟ Po...in.msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    lΡΚΟ Potwierdź numer telefonu w cią 48 godzin.msg
  • Size 54KB
  • Sample261027-lnt3dsszew
  • SHA256 9b488c8e9baa452791a170b2f01d62548d06655c12ead9e40dab41ee4b9c5a56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • lΡΚΟ Potwierdź numer telefonu w cią 48 godzin.msg
    .msg 54KB

lΡΚΟ Potwierdź numer telefonu w cią 48 godzin.msg

  • SHA256 9b488c8e9baa452791a170b2f01d62548d06655c12ead9e40dab41ee4b9c5a56
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Tue, 27 Oct 2026 09:30:26 +0000

Subject

=?utf-8?B?bM6hzprOnzogUG90d2llcmTFuiBudW1lciB0ZWxlZm9udSB3IGNpxIUgNDgg?= =?utf-8?Q?godzin?=

Content-Type

multipart/alternative; boundary="_000_2290597311052674179309342613010642182_"

Received

from WP-EX-02.intranet.ppl.corp (172.28.75.42) by WP-EX-02.intranet.ppl.corp (172.28.75.42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53 via Mailbox Transport; Tue, 27 Oct 2026 10:30:41 +0100

from WP-EX-04.intranet.ppl.corp (172.28.75.44) by WP-EX-02.intranet.ppl.corp (172.28.75.42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53; Tue, 27 Oct 2026 10:30:40 +0100

from wenus.ppl.pl (172.27.3.44) by poczta.ppl.pl (172.28.75.44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53 via Frontend Transport; Tue, 27 Oct 2026 10:30:40 +0100

from wenus.ppl.pl (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7F629A60CF for <[email protected]>; Tue, 27 Oct 2026 10:30:41 +0100 (CET)

from wenus.ppl.pl (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 09A4BA60AB for <[email protected]>; Tue, 27 Oct 2026 10:30:41 +0100 (CET)

from relayout01-q02.e.movistar.es (unknown [86.109.101.142]) by wenus.ppl.pl (Postfix) with ESMTPS for <[email protected]>; Tue, 27 Oct 2026 10:30:40 +0100 (CET)

from relayout03.e.movistar.es (relayout03.e.movistar.es [86.109.101.203]) by relayoutvt01.e.movistar.es (relayoutvt) with ESMTPS id 4jDQG53dkRz439g; Tue, 27 Oct 2026 10:30:37 +0100 (CET)

from webmail02 (ha-129-vl2755-bal01-02.acens.net [86.109.101.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: [email protected]) by relayout03.e.movistar.es (relayout) with ESMTPSA id 4jDQFt2nDQzMlNm; Tue, 27 Oct 2026 10:30:26 +0100 (CET)

Received-Spf

Pass (wenus.ppl.pl: domain of [email protected] designates 86.109.101.142 as permitted sender) identity=MAILFROM; client-ip=86.109.101.142; [email protected]; helo=relayout01-q02.e.movistar.es)

X-Mailer

Open-Xchange Mailer v7.10.5-Rev43

Message-Id

<[email protected]>

Extracted URLs

  • file https://ci3.googleusercontent.com/meips/ADKq_NY7jICq58vPEHKZ9lDBB7i2x5c9Y1F26O2Ge7zhps4VqKv8Mjhpb7NPZl18Y_Kxq1EtPup2GyVpdAR6C1wcMTizZEn_ACAS7qZJSR7vMr8R0SBqmCWYdQ=s0-d-e1-ft#https://www.ipko.pl/media_files/CiCCh/iPKO/logo-iko-simple-64.svg

  • file https://email.notify.thinkific.com/c/eJwczEFuhSAQANDTwJIMAzqwYNGN90BmqOSLGj_pj7dv2gs8TrlUzKglWYoOQiRLektQHE-uCvh5CoF9iTJb592KMEWKrFtCwNkCEgQMjgzxaslmrjKj9YzKw3GOVh8ztna8Wm3FlLPrPW1jXG_lvhQuCpd4HCaGbPozpF_mI-u7DVG49GvXd2Ix220-5_36E797bvs_85PwNwAA__9EqDfM

  • file https://fonts.gstatic.com/s/e/notoemoji/17.0/26a0_fe0f/72.png

  • file https://pnel.servicios-mail.com/unsuscribe/187118/eec45ec12b8f8f889d97687f0fa480d6/IpDBNmXHzju5Ctd8vfrpGjRJLTq0F79hfdLK7HcH6vlIOY8G5VdaZj14/

  • file https://static.acens.com/images/mails/acens/logo-telefonica-empresas.png

  • file https://www.ipko.pl