Overview

overview

1

Static

static

1

569b2ddf-c...52.eml

windows10-2004-x64

1

569b2ddf-c...52.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    569b2ddf-c85f-37fc-0e7c-a0a94f00a952.eml
  • Size 594KB
  • Sample261102-b689xsdh44
  • SHA256 a0fb22143702b3ae1bbdcb4b76a8c4585398e2b6fc2744acad50a3b613bb1256
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 569b2ddf-c85f-37fc-0e7c-a0a94f00a952.eml
    .eml 594KB
  • email-html-2.txt
    .html 1KB
  • email-plain-1.txt
    571B
  • sg_round_corner_gumroad_1_4_4.rbz
    .zip 423KB
  • sg_round_corner.rb
    842B
  • sg_round_corner/bridge.rbe
    16KB
  • sg_round_corner/extension.rbe
    918B
  • sg_round_corner/fillet.rbe
    16KB
  • sg_round_corner/icons/bevelup.svg
    .svg 2KB
  • sg_round_corner/license_config.json
    162B
  • sg_round_corner/licensing.rbe
    13KB
  • sg_round_corner/main.rbe
    3KB
  • sg_round_corner/profile.rbe
    49KB
  • sg_round_corner/selection.rbe
    27KB
  • sg_round_corner/sg_round_corner.susig
    1KB
  • sg_round_corner/ui/index.html
    .html .js 55KB
  • sg_round_corner/ui/kernel.js
    .js 639KB
  • sg_round_corner/ui/license.js
    .js 4KB
  • sg_round_corner/wireframe.rbe
    5KB

569b2ddf-c85f-37fc-0e7c-a0a94f00a952.eml

  • SHA256 a0fb22143702b3ae1bbdcb4b76a8c4585398e2b6fc2744acad50a3b613bb1256
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected

Email Headers

Return-Path

[email protected]

Date

Mon, 2 Nov 2026 01:01:42 +0000 (UTC)

Subject

skp plugins

Content-Type

multipart/mixed; boundary="----=_Part_457358_764322814.1793581302842"

Received

from KU3P306CA0013.MYSP306.PROD.OUTLOOK.COM (2603:1096:d10:15::18) by SEYPR02MB5509.apcprd02.prod.outlook.com (2603:1096:101:3e::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 01:01:53 +0000

from SG2PEPF000B66CA.apcprd03.prod.outlook.com (2603:1096:d10:15:cafe::80) by KU3P306CA0013.outlook.office365.com (2603:1096:d10:15::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.12 via Frontend Transport; Mon, 2 Nov 2026 01:01:52 +0000

from sonic314-20.consmr.mail.sg3.yahoo.com (106.10.240.144) by SG2PEPF000B66CA.mail.protection.outlook.com (10.167.240.22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.5 via Frontend Transport; Mon, 2 Nov 2026 01:01:51 +0000

from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.sg3.yahoo.com with HTTP; Mon, 2 Nov 2026 01:01:51 +0000

Received-Spf

Pass (protection.outlook.com: domain of yahoo.com designates 106.10.240.144 as permitted sender) receiver=protection.outlook.com; client-ip=106.10.240.144; helo=sonic314-20.consmr.mail.sg3.yahoo.com; pr=C

X-Mailer

WebService/1.1.26871 YahooMailAndroidMobile

Message-Id

<[email protected]>

Extracted URLs

  • file https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=

  • file https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer

  • file https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer