General

  • Target
    c09ed28e-c1fe-4117-7504-6e98b18c086b.eml
  • Size 71KB
  • Sample261102-cwspvsdh83
  • SHA256 aa8a213809199a568b74608a62f4ab40fb7d2670df84eba6ac203f4705164386
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • c09ed28e-c1fe-4117-7504-6e98b18c086b.eml
    .eml 71KB
  • SALES CONTRACT 2nd PO.docx
    .docx 20KB
  • email-html-2.txt
    .html 4KB
  • email-plain-1.txt
    548B
  • image.png
    .png 15KB

c09ed28e-c1fe-4117-7504-6e98b18c086b.eml

  • SHA256 aa8a213809199a568b74608a62f4ab40fb7d2670df84eba6ac203f4705164386
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
i[s4dD6AgC.O24}P^u.>

Email Headers

Return-Path

[email protected]

Date

Thu, 29 Oct 2026 14:47:56 +0000

Subject

2nd PO (sale contract)

Content-Type

multipart/mixed; boundary="_006_TYZPR03MB740983691386666F1454B9CF926E2TYZPR03MB7409apcp_"

Received

from SI1PR02CA0039.apcprd02.prod.outlook.com (2603:1096:4:1f6::9) by KL1PR06MB6347.apcprd06.prod.outlook.com (2603:1096:820:ce::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Thu, 29 Oct 2026 14:48:01 +0000

from SG1PEPF000082E3.apcprd02.prod.outlook.com (2603:1096:4:1f6:cafe::91) by SI1PR02CA0039.outlook.office365.com (2603:1096:4:1f6::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.8 via Frontend Transport; Thu, 29 Oct 2026 14:48:01 +0000

from TYDPR03CU002.outbound.protection.outlook.com (2a01:111:f403:c405::7) by SG1PEPF000082E3.mail.protection.outlook.com (2603:1096:f:fff6::44) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Thu, 29 Oct 2026 14:48:01 +0000

from TYZPR03MB7409.apcprd03.prod.outlook.com (2603:1096:400:41e::7) by KL1PR03MB7055.apcprd03.prod.outlook.com (2603:1096:820:dd::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.8; Thu, 29 Oct 2026 14:47:56 +0000

from TYZPR03MB7409.apcprd03.prod.outlook.com ([fe80::8961:69ed:586c:45d]) by TYZPR03MB7409.apcprd03.prod.outlook.com ([fe80::8961:69ed:586c:45d%5]) with mapi id 15.21.0569.008; Thu, 29 Oct 2026 14:47:56 +0000

Received-Spf

Pass (protection.outlook.com: domain of thayafood.com designates 2a01:111:f403:c405::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c405::7; helo=TYDPR03CU002.outbound.protection.outlook.com; pr=C

Message-Id

<TYZPR03MB740983691386666F1454B9CF926E2@TYZPR03MB7409.apcprd03.prod.outlook.com>

Extracted URLs

  • file http://www.thaya.com