Overview

overview

7

Static

static

1

Message.eml

windows10-2004-x64

7

Message.eml

windows11-ltsc_2024-x64

1

Resubmissions

10/11/2026, 18:23

261110-w1vvka1s6p

10/11/2026, 17:32

261110-v39aasb1917

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 28KB
  • Sample261110-v39aasb191
  • SHA256 464e6f2786ed5ec7ae42dcfb5c42116b89889951e78d49c96689675b4bc9c6b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 28KB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    2KB

Message.eml

  • SHA256 464e6f2786ed5ec7ae42dcfb5c42116b89889951e78d49c96689675b4bc9c6b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
$3curity!@#

Email Headers

Return-Path

[email protected]

Date

Tue, 10 Nov 2026 15:45:18 +0000

Subject

(EXTERNAL) Completed Contract Agreement from Stuart Green - Please review ID:rYtpTZ3qb6MV8VO3

Content-Type

multipart/alternative; boundary="===============73718684640887506692=="

Received

from CH5P222CA0011.NAMP222.PROD.OUTLOOK.COM (2603:10b6:610:1ee::26) by CHBPR12MB971693.namprd12.prod.outlook.com (2603:10b6:610:340::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.615.8; Tue, 10 Nov 2026 15:45:19 +0000

from CH2PEPF000166BD.namprd04.prod.outlook.com (2603:10b6:610:1ee:cafe::26) by CH5P222CA0011.outlook.office365.com (2603:10b6:610:1ee::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.8 via Frontend Transport; Tue, 10 Nov 2026 15:45:19 +0000

from [192.210.194.20] (192.210.194.20) by CH2PEPF000166BD.mail.protection.outlook.com (10.167.252.7) with Microsoft SMTP Server id 15.21.615.4 via Frontend Transport; Tue, 10 Nov 2026 15:45:18 +0000

Received-Spf

Fail (protection.outlook.com: domain of teamwendy.com does not designate 192.210.194.20 as permitted sender) receiver=protection.outlook.com; client-ip=192.210.194.20; helo=[192.210.194.20];

Message-Id

<ca4eada8-3f5a-4e1b-9cfb-728eee8681de@CH2PEPF000166BD.namprd04.prod.outlook.com>

Extracted URLs

  • file https://graph.microsoft.com/User.Read&prompt=none&client_id=c521d5a5-4854-4eac-9ecb-89abbbf536de&ref=06f2b88d-dc65-418f-9088-409b2e6ebd5d&uri=

  • file https://login.microsoft.com///////////////common/oauth2/v2.0/authorize?state=YXN1bmRhcmFtdXJ0aHlAdGVhbXdlbmR5LmNvbQ==&scope=openid+profile+https://graph.microsoft.com/User.Read&prompt=none&client_id=c521d5a5-4854-4eac-9ecb-89abbbf536de&ref=06f2b88d-dc65-418f-9088-409b2e6ebd5d&uri=https%25252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252Flogin.microsoftonline.com%25252525252525252525252525252525252525252525252Fcommon%25252525252525252525252525252525252525252525252Foauth2%25252525252525252525252525252525252525252525252Fv2.0%25252525252525252525252525252525252525252525252Fauthorize%25252525252525252525252525252525252525252525253Fclient_id%25252525252525252525252525252525252525252525253D7c5d944f-2a6f-49cc-b794-f5072c22086a%252525252525252525252525252525252525252525252526response_type%25252525252525252525252525252525252525252525253Dcode%252525252525252525252525252525252525252525252526response_mode%25252525252525252525252525252525252525252525253Dquery%252525252525252525252525252525252525252525252526scope%25252525252525252525252525252525252525252525253Dopenid%25252525252525252525252525252525252525252525252Bprofile%25252525252525252525252525252525252525252525252Bemail%25252525252525252525252525252525252525252525252Bhttps%25252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252Fgraph.microsoft.com%25252525252525252525252525252525252525252525252FUser.Read%252525252525252525252525252525252525252525252526prompt%25252525252525252525252525252525252525252525253Dnone%252525252525252525252525252525252525252525252526state%25252525252525252525252525252525252525252525253D%25252525252525252525252525252525252525252525257BRECIPIENT_BASE64_EMAIL%25252525252525252525252525252525252525252525257D

  • file https://login.microsoft.com/common/oauth2/v2.0/authorize?state=YXN1bmRhcmFtdXJ0aHlAdGVhbXdlbmR5LmNvbQ==&scope=openid+profile+