Resubmissions

22/07/2026, 16:02

260722-thaessycpg4

22/07/2026, 15:58

260722-texe6avvet3

General

  • Target
    4847b791-2372-e715-821b-af8b13dc13a1.eml
  • Size 23KB
  • Sample260722-thaessycpg
  • SHA256 7a1639284a075139e5ac5faa27b3218ad45eaeefa6552696dcaa0c32a78c9d9e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 4847b791-2372-e715-821b-af8b13dc13a1.eml
    .eml 23KB
  • email-html-2.txt
    .html 11KB
  • email-plain-1.txt
    1KB

4847b791-2372-e715-821b-af8b13dc13a1.eml

  • SHA256 7a1639284a075139e5ac5faa27b3218ad45eaeefa6552696dcaa0c32a78c9d9e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

Michelle Forrester via Docusign <[email protected]>

Return-Path

[email protected]

Date

Wed, 22 Jul 2026 07:28:27 -0700

Subject

Statement of Work Contract Payapp #00564-32130

Content-Type

multipart/alternative; boundary="=-nfuATgExDYoSEqSms1GDyQ=="; charset="utf-8"

Received

from SJ0PR13MB5426.namprd13.prod.outlook.com (2603:10b6:a03:420::15) by SA1PR13MB5007.namprd13.prod.outlook.com with HTTPS; Wed, 22 Jul 2026 14:28:36 +0000

from MN2PR03CA0021.namprd03.prod.outlook.com (2603:10b6:208:23a::26) by SJ0PR13MB5426.namprd13.prod.outlook.com (2603:10b6:a03:420::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Wed, 22 Jul 2026 14:28:29 +0000

from BL6PEPF00020E5F.namprd04.prod.outlook.com (2603:10b6:208:23a:cafe::86) by MN2PR03CA0021.outlook.office365.com (2603:10b6:208:23a::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.10 via Frontend Transport; Wed, 22 Jul 2026 14:28:28 +0000

from mailda.docusign.net (64.207.219.135) by BL6PEPF00020E5F.mail.protection.outlook.com (10.167.249.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Wed, 22 Jul 2026 14:28:28 +0000

from cuese4fe12p01.corp.docusign.net (unknown [10.103.81.137]) by mailda.docusign.net (Postfix) with ESMTP id B418A30177CC for <[email protected]>; Wed, 22 Jul 2026 14:28:27 +0000 (UTC)

from cuese4fe12p01 ([127.0.0.1]) by cuese4fe12p01.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697); Wed, 22 Jul 2026 07:28:27 -0700

Received-Spf

Pass (protection.outlook.com: domain of docusign.net designates 64.207.219.135 as permitted sender) receiver=protection.outlook.com; client-ip=64.207.219.135; helo=mailda.docusign.net; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://na4.docusign.net/Signing/EmailStart.aspx?a=67f51fc1-ed60-8b62-8398-686c2294ab72&etti=25&acct=fefd4f0b-5d81-480d-96d2-3b2a4ff00aa5&er=6d9196bc-5043-84a0-83be-d25370c757ff

  • file https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi10ukDc9BiaoghTsrhfO1GkYMy3oWXUTS9VMTIWvu7O52RTVdnH1BfFBRpbgOVCFnmWWXsvRhn6m9iEhhqPJj1ROKzCt0sVUQmCT2kXmMkB5fqbNwtax5IwmS_M0dQjJvI2PX0qprcQuqfFg7m3DCiYuQISPtD1nQ2Vxmo-N3LAtm-TSzFSnRXULIFojW3r10rjNpat9D3fhLJES4sawAPBY0zz8gAdtt1BNd7XWGD68XQDUZyrtUaFMjP4Fj6H0lNfwvPWHRdxd3YoWPco9MGXrsg6XkjfReoRmosqc-RedTDQWmWcWAYirzX-lWeDkSfUcqO43Bzb2MgfHcE-b_OOQBUAz4wQilS-LvZrJpGMFyHDO_KSkgYZHDv1KG5CgefLUV5X-IaaxxcXa0hJjzHSUoaIPpZdsIZ1zcBCZtGbPCxTWxQVeZD5nL_MI6VnXBv5xQ2XfNWaQNAXXQflV_gat&lang=en

  • file https://support.docusign.com/

  • file https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&#38;utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&%2338;utm_medium=product&%2338;utm_source=postsend

  • file https://support.docusign.com/s/contactSupport?language=en_US

  • file https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend

  • file https://www.docusign.com/legal/terms-and-conditions

  • file https://www.docusign.com/privacy