Message[.]eml | Triage™

General

Target
Message.eml
Size 63KB
Sample260720-ss3cwsev2l
SHA256 7001a71edfa179697ba5ab646a2e5e14fd8b1d316a1ef3d1952168c19b0f5feb
MD5 2db74f22d6bece5412b0940399d5ab48
SHA1 14c25e7b16299b5d8a3802d666b2f66d062d3d00
SHA512 0215be32377d8c2aba4b7e5edfd007f6ac1fc0b62c81205ba838f2364455d98c683f78c44851aa4d74dcfbd0b874ad5fd6e9b68505300cc08605011f2a1643bb
SSDEEP 1536:Gy82RM0aA8Py+nGYIvnseeZsJ0sphMA9qy:k2ROACDnGYIvn4OPphMA9D
TLSH
T1B9538344C2C061512C7B49EC72E13ED69AE0EC6C96E111B4BC6DD85AAFC8D3576138FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Message.eml

.eml 63KB
email-html-2.txt

39KB
email-plain-1.txt

7KB

Message.eml

SHA256 7001a71edfa179697ba5ab646a2e5e14fd8b1d316a1ef3d1952168c19b0f5feb
MD5 2db74f22d6bece5412b0940399d5ab48
SHA1 14c25e7b16299b5d8a3802d666b2f66d062d3d00
SHA512 0215be32377d8c2aba4b7e5edfd007f6ac1fc0b62c81205ba838f2364455d98c683f78c44851aa4d74dcfbd0b874ad5fd6e9b68505300cc08605011f2a1643bb
SSDEEP 1536:Gy82RM0aA8Py+nGYIvnseeZsJ0sphMA9qy:k2ROACDnGYIvn4OPphMA9D
TLSH
T1B9538344C2C061512C7B49EC72E13ED69AE0EC6C96E111B4BC6DD85AAFC8D3576138FE
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

bounces+45355735-ef02-carmelita.hernandez=tceq.texas.gov@em8285.sales.kiaofroundrock.com

Date

Mon, 20 Jul 2026 14:21:22 +0000 (UTC)

Subject

You are already one step ahead

Content-Type

multipart/alternative; boundary="464464fff76e43cd85df90f7b5a10e48";

Received

from CYZPR12CA0010.namprd12.prod.outlook.com (2603:10b6:930:8b::26) by MW4PR13MB5482.namprd13.prod.outlook.com (2603:10b6:303:182::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 14:21:24 +0000

from CY4PEPF0000E9CE.namprd03.prod.outlook.com (2603:10b6:930:8b:cafe::ad) by CYZPR12CA0010.outlook.office365.com (2603:10b6:930:8b::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.18 via Frontend Transport; Mon, 20 Jul 2026 14:21:24 +0000

from o33.sg01.motosnap.com (168.245.29.92) by CY4PEPF0000E9CE.mail.protection.outlook.com (10.167.241.133) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Mon, 20 Jul 2026 14:21:23 +0000

by recvd-8585b85bc9-vx6hv with SMTP id recvd-8585b85bc9-vx6hv-1-6A5E2EE2-5 2026-07-20 14:21:22.035765247 +0000 UTC m=+921497.884073629

from SGASEGRPR-QTS06 (unknown) by geopod-ismtpd-39 (SG) with ESMTP id 03IIEVg3QQWe13oGpcWMCg for <[email protected]>; Mon, 20 Jul 2026 14:21:21.865 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of em8285.sales.kiaofroundrock.com designates 168.245.29.92 as permitted sender) receiver=protection.outlook.com; client-ip=168.245.29.92; helo=o33.sg01.motosnap.com; pr=C

Message-Id

<bUcVzGxxQzXgm3jr5I0ojHKAID3QUok1+W8p9HfCkijwClNx+FdeBa9BgMUstDkZN/[email protected]>

Extracted URLs

file http://vinurl.com/1784557281491-M71NK92XS64T
file http://vinurl.com/1784557281498-P31JZ57YN40D
file http://vinurl.com/1784557281503-J15WX42YQ03C
file https://apps.vinmanager.com/Cardashboard/LeadManagement/EmailUnsubscribe.aspx?almid=e8vby60twT%2fw%2b0SXuqXCPQ%3d%3d&drid=&gcid=KGKbjFwPx7BL%2bux35cuFzA%3d%3d&email=rcJ7lxOHpdefge1nbnRcW4tROVnP%2fDbPM9Til05mqXZBZQwzhvPfsA%3d%3d&did=PuEIJLixKlQ%3d
file https://www.kiaofroundrock.com%E2%80%9CMovement
file https://www.kiaofroundrock.com/

Sharing