Message[.]eml | Triage™

General

Target
Message.eml
Size 14KB
Sample260623-ydeaeafz21
SHA256 1c27dbbe94726079456f03e45c2030835d394e44324b6e4a4b2176514ed17b11
MD5 6b18edf2faf312335f27602ba1a023b6
SHA1 0292604920639c5e4f8d31a18d1c5b28fa61beee
SHA512 1cc312424930ffebeaad7e862713efcfadd6709871b3926f703e5c495295ed216c5452e36cac7c6a01aee691c7108ab7a31d1a7a1a712d82d938667adac3862b
SSDEEP 384:v1gmn/GwN+aD6kL6LlucTZoDK+9NtlsAPR0YcRhW:v7/Gr46kqY0IH91sApBc6
TLSH
T127624B59AEA318B1DDA274CD2C01FD0B61931D63A9B3D0E42CAB7677019F5FB6F0064A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Message.eml

.eml 14KB
email-html-2.txt

3KB
email-plain-1.txt

378B

Message.eml

SHA256 1c27dbbe94726079456f03e45c2030835d394e44324b6e4a4b2176514ed17b11
MD5 6b18edf2faf312335f27602ba1a023b6
SHA1 0292604920639c5e4f8d31a18d1c5b28fa61beee
SHA512 1cc312424930ffebeaad7e862713efcfadd6709871b3926f703e5c495295ed216c5452e36cac7c6a01aee691c7108ab7a31d1a7a1a712d82d938667adac3862b
SSDEEP 384:v1gmn/GwN+aD6kL6LlucTZoDK+9NtlsAPR0YcRhW:v7/Gr46kqY0IH91sApBc6
TLSH
T127624B59AEA318B1DDA274CD2C01FD0B61931D63A9B3D0E42CAB7677019F5FB6F0064A
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Reply-To

emailcustomerreply+f5932853-90fd-4c36-a123-d0850766953b@classicchevycadillactexoma.com

Return-Path

bounces+48002152-8397-brennan.ledbetter=tceq.texas.gov@email.drivecampaigns.com

Date

Tue, 23 Jun 2026 19:31:46 +0000 (UTC)

Subject

MUNICIPAL & GOVERMENT LEASING SPECIAL

Content-Type

multipart/alternative; boundary=6b5bd6b58c3809c21257b1f72d1fb381f6e4c8b3aa803d8e13955486a3b8

Received

from BL1P222CA0016.NAMP222.PROD.OUTLOOK.COM (2603:10b6:208:2c7::21) by SN4PR13MB5264.namprd13.prod.outlook.com (2603:10b6:806:1eb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Tue, 23 Jun 2026 19:31:47 +0000

from BN3PEPF0000B373.namprd21.prod.outlook.com (2603:10b6:208:2c7:cafe::1b) by BL1P222CA0016.outlook.office365.com (2603:10b6:208:2c7::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.20 via Frontend Transport; Tue, 23 Jun 2026 19:31:47 +0000

from o31.mail.drivecampaigns.com (149.72.240.130) by BN3PEPF0000B373.mail.protection.outlook.com (10.167.243.170) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.0 via Frontend Transport; Tue, 23 Jun 2026 19:31:46 +0000

by recvd-6b97fcbd9f-vbgqq with SMTP id recvd-6b97fcbd9f-vbgqq-1-6A3ADF22-19 2026-06-23 19:31:46.118116492 +0000 UTC m=+74410.091423282

from NDgwMDIxNTI (unknown) by geopod-ismtpd-97 (SG) with HTTP id lEdu-AGQS9iWLRHR0n3UeQ Tue, 23 Jun 2026 19:31:46.094 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of email.drivecampaigns.com designates 149.72.240.130 as permitted sender) receiver=protection.outlook.com; client-ip=149.72.240.130; helo=o31.mail.drivecampaigns.com; pr=C

Message-Id

<be57f2e0-0e00-4a43-b643-0156debc8396.f5932853-90fd-4c36-a123-d0850766953b@blastmailer.drivecentric.com>

Extracted URLs

file http://email.drivecampaigns.com/ls/click?upn=u001.e9QBJGLfL1mTSyg-2FzVxCYMKBm12m-2FP0bqlQfNRJySEqjARua1vX7piebY7n2qEsLLS5TSA0D8q4UoQxFLB9Es5DxFexrsFuoLAvw8PfdnJ3NNp-2F-2FNlM57z99jReuJ-2FM-2BIybf0Rr0Riv-2FBXLO9ljJqjeRIx7xd0k23MvNRGlxcipcChI-2FwsoSoh-2BKHtlMEq9RbNbV-2BVxxB-2B1cBo3FQViDkYx7LHPzoHv-2BSq3z4ruFJBwTtqYVA7D6D1SoV4FOupVrSBkmXdhpuA0qcnHmrICiJWQmotbYzFckA7jlM03NTRdHSEjkgLDd028r3x8GQo9OCJqW3NkdacHdIWEuipVFHmGi6FiU-2BkpwU8paxjbhLqcYIKbT2pDby9IX7f7NN58PbHEvr3hKvdh0kjs5GFtjEA-3D-3D-Au4_NwjDQclA0V2i6cRbwNIfldzaxy05zViZI28HE-2FqL7sEHi7JpYgOKKhI8WyLHP47O3tqibornPQLvZzTBocQl3-2B6qW1R3INWnz1uAEcm8NkHCSlmFuO8NUVbCZv5tP-2FbE-2FDOA3eWjoZBow5yINNnDjMXq37yhiHuzA4Mti6Wt47TbLJzLv-2FLWOF-2B1GpGt9tvknHd13Eag5SbBF7JVLzze4qVD9D31uvN-2Frkb-2FqPEP7I68CmLrOKxbQKGnhjDvfH4bbv6DL-2FtroVmVOjMUDWN2DR0-2FaLvhNx307mCmj4PPORKL61IhLS1RetDi5hEkscYSyKo-2FH99Mz75lfNLM9G8XhqSHk2FUoU-2B6pMXIby9Sfgdc6l7WBwRh2TT3maxdihPjI1u2kvadsykPAQARj5wgsg-3D-3D

Sharing