Overview

overview

4

Static

static

1

Message.eml

windows10-2004-x64

1

Message.eml

windows11-ltsc_2024-x64

4

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

4

Resubmissions

09/07/2026, 14:36

260709-ryqqlscy8s4

09/07/2026, 14:33

260709-rwz69sb18k4

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 92KB
  • Sample260709-ryqqlscy8s
  • SHA256 800aa7396240af28aeb66b50a7445b38e2995c121a522bb5bdfd669d49419142
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 92KB
  • email-html-1.txt
    .html 80KB

Message.eml

  • SHA256 800aa7396240af28aeb66b50a7445b38e2995c121a522bb5bdfd669d49419142
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 8 Jul 2026 17:09:16 -0500 (CDT)

Subject

Your shipment is scheduled for delivery tomorrow 874103203802

Content-Type

multipart/mixed; boundary="----=_Part_1179449_398511077.1783548556671"

Received

from SA9PR03CA0010.namprd03.prod.outlook.com (2603:10b6:806:20::15) by IA2PR13MB6587.namprd13.prod.outlook.com (2603:10b6:208:4ab::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.10; Wed, 8 Jul 2026 22:09:19 +0000

from SN1PEPF000252A4.namprd05.prod.outlook.com (2603:10b6:806:20:cafe::ae) by SA9PR03CA0010.outlook.office365.com (2603:10b6:806:20::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.10 via Frontend Transport; Wed, 8 Jul 2026 22:09:19 +0000

from mx43-out.infosec.fedex.com (199.81.208.34) by SN1PEPF000252A4.mail.protection.outlook.com (10.167.242.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Wed, 8 Jul 2026 22:09:19 +0000

from pps.filterd (mx43-out.infosec.fedex.com [127.0.0.1]) by mx43-out.infosec.fedex.com (8.18.1.2/8.18.1.2) with ESMTP id 668L0PSr018944 for <[email protected]>; Wed, 8 Jul 2026 17:09:18 -0500

from pvma45200.prod.iaas.fedex.com (pvma45200.prod.iaas.fedex.com [199.81.10.146]) by mx43-out.infosec.fedex.com (PPS) with ESMTPS id 4f73sn389q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Wed, 08 Jul 2026 17:09:17 -0500

from p1090450.prod.cloud.fedex.com (p1090450.prod.cloud.fedex.com [10.228.159.88]) by pvma45200.prod.iaas.fedex.com (8.18.1.8/8.18.1.8) with ESMTPS id 668M95kf559967 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for <[email protected]>; Wed, 8 Jul 2026 22:09:16 GMT

from p1090450.prod.cloud.fedex.com (localhost [127.0.0.1]) by p1090450.prod.cloud.fedex.com (8.15.2/8.15.2) with ESMTP id 668M9564729804 for <[email protected]>; Wed, 8 Jul 2026 22:09:16 GMT

Received-Spf

Pass (protection.outlook.com: domain of nds.fedex.com designates 199.81.208.34 as permitted sender) receiver=protection.outlook.com; client-ip=199.81.208.34; helo=mx43-out.infosec.fedex.com; pr=C

Message-Id

<233495483.11793701783548556671.JavaMail.nds@p1090450.prod.cloud.fedex.com>

Extracted URLs

  • file https://www.fedex.com/apps/fedextrack?trknbr=874103203802&intcmp=notifType:1020%7CnotifSource:ALL%7CCTA:TRKS

  • file https://www.fedex.com/apps/fedextrack?trknbr=874103203802&manageDelivery

  • file https://www.fedex.com/apps/fedextrack?trknbr=874103203802&manageDelivery=shipAlertHAL&token=yt1.VQvh0gD2tpZ6dnJHI7DNjanxqWfbD4zR&intcmp=notifType:1020%7CnotifSource:SEC%7CCTA:RTH

  • file https://www.fedex.com/en-us/shipping/mobile.html?CMP=EMT-1008477-2-1-200-0000100-US-US-EN-G2COREMANFDM000

  • file https://www.fedex.com/en-us/trust-center/privacy.html