General

  • Target
    Message.eml
  • Size 64KB
  • Sample260701-sl87vsgz2r
  • SHA256 f73ae920539b76886d4ff0096514f2e1a7d5020c4328fe30cb968cbfafd71e68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 64KB
  • Outlook-image.jpg
    .jpg 11KB
  • Outlook-vp4zv2u5.png
    .jpg 5KB
  • email-html-2.txt
    .html 11KB
  • email-plain-1.txt
    1KB

Message.eml

  • SHA256 f73ae920539b76886d4ff0096514f2e1a7d5020c4328fe30cb968cbfafd71e68
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 29 Jun 2026 22:45:57 +0000

Subject

Ashton: 972-314-3794

Content-Type

multipart/related; boundary="_006_LV9PR02MB1118172BA195DE1B72F495E979FE82LV9PR02MB11181na_"; type="multipart/alternative"

Received

from DS7P222CA0025.NAMP222.PROD.OUTLOOK.COM (2603:10b6:8:2e::31) by BY5PR13MB3779.namprd13.prod.outlook.com (2603:10b6:a03:229::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Mon, 29 Jun 2026 22:47:38 +0000

from DS2PEPF000061C5.namprd02.prod.outlook.com (2603:10b6:8:2e:cafe::37) by DS7P222CA0025.outlook.office365.com (2603:10b6:8:2e::31) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.19 via Frontend Transport; Mon, 29 Jun 2026 22:47:38 +0000

from mx0b-00191d01.pphosted.com (67.231.157.136) by DS2PEPF000061C5.mail.protection.outlook.com (10.167.23.72) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Mon, 29 Jun 2026 22:47:38 +0000

from pps.filterd (m0288869.ppops.net [127.0.0.1]) by m0288869.ppops.net-00191d01. (8.18.1.11/8.18.1.11) with ESMTP id 65TKemiO2449041; Mon, 29 Jun 2026 18:46:47 -0400

from flpd657.enaf.ffdc.sbc.com (sbcsmtp9.sbc.com [144.160.128.153]) by m0288869.ppops.net-00191d01. (PPS) with ESMTPS id 4f3xbxkm1n-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 29 Jun 2026 18:46:46 -0400 (EDT)

from enaf.ffdc.sbc.com (localhost [127.0.0.1]) by flpd657.enaf.ffdc.sbc.com (8.16.1/8.14.5) with ESMTP id 65TMkjAY111548; Mon, 29 Jun 2026 15:46:45 -0700

from zlp25944.vci.att.com (zlp25944.vci.att.com [135.213.92.140]) by flpd657.enaf.ffdc.sbc.com (8.16.1/8.14.5) with ESMTPS id 65TMkTTZ111175 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 29 Jun 2026 15:46:30 -0700

from zlp25944.vci.att.com (zlp25944.vci.att.com [127.0.0.1]) by zlp25944.vci.att.com (Service) with ESMTP id 9D670410F42D; Mon, 29 Jun 2026 22:46:29 +0000 (GMT)

from CAFRFD1MSGEX5ED.ITServices.sbc.com (unknown [135.147.202.233]) by zlp25944.vci.att.com (Service) with ESMTP id 8A11A410F426; Mon, 29 Jun 2026 22:46:28 +0000 (GMT)

from CAFRFD1MSGEX5ED.ITServices.sbc.com (135.147.202.233) by CAFRFD1MSGEX5ED.ITServices.sbc.com (135.147.202.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Mon, 29 Jun 2026 15:46:27 -0700

from CAFRFD1MSGETA07.tmg.ad.att.com (144.160.143.86) by CAFRFD1MSGEX5ED.ITServices.sbc.com (135.147.202.233) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43 via Frontend Transport; Mon, 29 Jun 2026 15:46:27 -0700

from BL2PR08CU001.outbound.protection.outlook.com (40.93.4.9) by edgeFF.exch.att.com (144.160.143.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Mon, 29 Jun 2026 15:46:26 -0700

from LV9PR02MB11181.namprd02.prod.outlook.com (2603:10b6:408:367::22) by PH0PR02MB7702.namprd02.prod.outlook.com (2603:10b6:510:56::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.19; Mon, 29 Jun 2026 22:45:57 +0000

from LV9PR02MB11181.namprd02.prod.outlook.com ([fe80::8763:1ef0:2ab:5ec8]) by LV9PR02MB11181.namprd02.prod.outlook.com ([fe80::8763:1ef0:2ab:5ec8%2]) with mapi id 15.21.0159.018; Mon, 29 Jun 2026 22:45:57 +0000

Received-Spf

Pass (protection.outlook.com: domain of att.com designates 67.231.157.136 as permitted sender) receiver=protection.outlook.com; client-ip=67.231.157.136; helo=mx0b-00191d01.pphosted.com; pr=C

Message-Id

<LV9PR02MB1118172BA195DE1B72F495E979FE82@LV9PR02MB11181.namprd02.prod.outlook.com>

Extracted URLs

  • file https://hello-business.att-mail.com/api/mailings/click/PMRGSZBCHIYTMNBQHA4DCOJMEJ2XE3BCHIRGQ5DUOBZTULZPNBSWY3DPFVRHK43JNZSXG4ZOMF2HILLNMFUWYLTDN5WS6YZPIFMDQOBVI4RCYITPOJTSEORCMRRDCMBXME3DSLLBMFSWKLJUGAZDCLJYGE3TMLJUMY4TEMZWGVQTSYZSGERCYITWMVZHG2LPNYRDUIRUEIWCE43JM4RDUISLMJPVO23MJFHW4RKRIEZDK522OQ3FMNBWORWEY2KYJ5QXGVCJIFKEQSBNHFRU65LCJRCT2IT5?elqTrackId=a8f20583523047acbf6654962a50fda1