Overview

overview

1

Static

static

1

suspected_...3).eml

windows10-2004-x64

1

suspected_...3).eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    suspected_phishing_email (93).eml
  • Size 8KB
  • Sample261104-ybvjlscz21
  • SHA256 3f4e9a37e14798c5aab454ab231fd85339eb1f0232c2b4d9a91be2be477f5319
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • suspected_phishing_email (93).eml
    .eml 8KB

suspected_phishing_email (93).eml

  • SHA256 3f4e9a37e14798c5aab454ab231fd85339eb1f0232c2b4d9a91be2be477f5319
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 04 Nov 2026 18:11:17 GMT

Wed, 4 Nov 2026 18:11:07 +0000

Subject

Weekly meeting

Weekly meeting

Content-Type

text/html; charset=UTF-8

Received

from LV3PR04MB9516.namprd04.prod.outlook.com (2603:10b6:408:290::16) by BY5PR04MB6756.namprd04.prod.outlook.com with HTTPS; Wed, 4 Nov 2026 18:11:16 +0000

from CH0PR04CA0053.namprd04.prod.outlook.com (2603:10b6:610:77::28) by LV3PR04MB9516.namprd04.prod.outlook.com (2603:10b6:408:290::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Wed, 4 Nov 2026 18:11:12 +0000

from CH01EPF000BE941.namprd02.prod.outlook.com (2603:10b6:610:77:cafe::10) by CH0PR04CA0053.outlook.office365.com (2603:10b6:610:77::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.10 via Frontend Transport; Wed, 4 Nov 2026 18:11:12 +0000

from dormouse.ash.relay.mailchannels.net (23.83.222.50) by CH01EPF000BE941.mail.protection.outlook.com (10.167.244.133) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.5 via Frontend Transport; Wed, 4 Nov 2026 18:11:12 +0000

from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id F3E637A0D9E; Wed, 04 Nov 2026 18:11:10 +0000 (UTC)

from [127.0.0.1] (100-99-188-64.trex-nlb.outbound.svc.cluster.local [100.99.188.64]) (Authenticated sender: arapahoedentalnet) by relay.mailchannels.net (Postfix) with ESMTPA id ABC2E7A04EB for <[email protected]>; Wed, 04 Nov 2026 18:11:10 +0000 (UTC)

from [127.0.0.1] ([UNAVAILABLE]. [187.14.230.160]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256) by 100.99.188.64 (trex/8.0.2); Wed, 04 Nov 2026 18:11:10 +0000

Received-Spf

Pass (protection.outlook.com: domain of fincasgelabert.com designates 23.83.222.50 as permitted sender) receiver=protection.outlook.com; client-ip=23.83.222.50; helo=dormouse.ash.relay.mailchannels.net; pr=C

Message-Id

<[email protected]>