Overview

overview

4

Static

static

1

Message.eml

windows10-2004-x64

4

Message.eml

windows11-ltsc_2024-x64

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 28KB
  • Sample260715-tsrf3aby4x
  • SHA256 282f729cd4eb898c3a035122779be7c75e08bf31685fa955a8fd2e38e5ca304e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 28KB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    2KB

Message.eml

  • SHA256 282f729cd4eb898c3a035122779be7c75e08bf31685fa955a8fd2e38e5ca304e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 15 Jul 2026 10:39:01 -0500 (CDT)

Subject

=?UTF-8?Q?Legacy_Inspections_=E2=86=92_Digital_?= =?UTF-8?Q?Public_Service_(See_the_Story)?=

Content-Type

multipart/alternative; boundary="----=_Part_692088_1464122437.1784129941921"

Received

from CH0P221CA0002.NAMP221.PROD.OUTLOOK.COM (2603:10b6:610:11c::10) by PH0PR13MB5495.namprd13.prod.outlook.com (2603:10b6:510:12a::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Wed, 15 Jul 2026 15:39:04 +0000

from CH1PEPF0000AD75.namprd04.prod.outlook.com (2603:10b6:610:11c:cafe::39) by CH0P221CA0002.outlook.office365.com (2603:10b6:610:11c::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.12 via Frontend Transport; Wed, 15 Jul 2026 15:39:04 +0000

from bounce.neudesic.com (199.15.214.136) by CH1PEPF0000AD75.mail.protection.outlook.com (10.167.244.54) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Wed, 15 Jul 2026 15:39:04 +0000

from marketo-platform--email-sender-prod-batch-cluster-5df47c87qfh9k (44.235.171.179) by or2-prod2-kumo-mta-i-0b26172e5d62ece8d (KumoMTA 10.186.211.135) with ESMTP id 4dbb70a9806311f1b4760669f53a6c35 for <[email protected]>; Wed, 15 Jul 2026 15:39:01 +0000

Received-Spf

Pass (protection.outlook.com: domain of bounce.neudesic.com designates 199.15.214.136 as permitted sender) receiver=protection.outlook.com; client-ip=199.15.214.136; helo=bounce.neudesic.com; pr=C

Message-Id

<1298544337.692089.1784129941922@marketo-platform--email-sender-prod-batch-cluster-5df47c87qfh9k>

Extracted URLs

  • file https://

  • file https://info.neudesic.com/UnsubscribePage.html?mkt_unsubscribe=1&mkt_tok=NjAwLVFDTC02MzYAAAGjBWchnp3hQ4FbzM2nDU73U_9bKEh_Wumtb5R80sVnTw6Ad8fyu3CdG2vgTlL8K6Di9x46T6vM-q9LntNuU35NjhO_6lL6DVIBgFNFkMVy12Kj-w

  • file https://info.neudesic.com/UnsubscribePage.html?mkt_unsubscribe=1&mkt_tok=NjAwLVFDTC02MzYAAAGjBWchnp3hQ4FbzM2nDU73U_9bKEh_Wumtb5R80sVnTw6Ad8fyu3CdG2vgTlL8K6Di9x46T6vM-q9LntNuU35NjhO_6lL6DVIBgFNFkMVy12Kj-w]]

  • file https://marketo.neudesic.com/NjAwLVFDTC02MzYAAAGjBWchnUJy7U3xN44LdgcAsk9tUSgX9p-Gx_HqgvFMqDPaOTRgPW-gXiNW5-kuuMrMKX3p5KU=

  • file https://marketo.neudesic.com/dc/tuFXF2NnVydxb5fq6tyA3b_rsP1VF5RlQpdZP2sZnNa4eERkIa_82EXcwglU47-3lsX5yE6Bew4v5QpDkCCd1MoR47AQ1bjxlzyjNag9cbQfQSY639IhG89cu4lbAWgVcDv1vR3B0HMlJbdW_uNETk3gHWd2p9hveKsPR92Bet_GJ_DJGIVejF3FM6pCM3dKx4m7plbazmcf4QLWNJkw662Z-ckcRmhdHkpkTxRXB0jy_tfPty_9-dsce0k97n39_Zbzqy6B1uPmxNpxD7U6rNdsSzrNFSwMJLW3J82VGjc=/NjAwLVFDTC02MzYAAAGjBWchnWjHlFL8YGnUZr27ESiO7Jjwr-vr8cqUOJH3gL8fn4kzq6V2XGZVs2MleiDw3Qxr_m4=

  • file https://marketo.neudesic.com/dcn/pbGPhb-hfIKAyC6tvgoUvpt6O5TMIGcOhfyDBwX6WhPHp-bkp6-198qKz32X9k5CCYiLzX3hKmBJf1jlqdHPVA==/NjAwLVFDTC02MzYAAAGjBWchnWjHlFL8YGnUZr27ESiO7Jjwr-vr8cqUOJH3gL8fn4kzq6V2XGZVs2MleiDw3Qxr_m4=

  • file https://www.linkedin.com/in/steven-felger-4a730034/