Overview

overview

3

Static

static

1

Message.eml

windows10-2004-x64

3

Message.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 53KB
  • Sample260807-ernw8adh55
  • SHA256 f1f8eae263023b733fbd76fc7e45c903c0bda614b708d51a535253f4623d9d41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 53KB
  • email-html-2.txt
    .html 15KB
  • email-plain-1.txt
    4KB

Message.eml

  • SHA256 f1f8eae263023b733fbd76fc7e45c903c0bda614b708d51a535253f4623d9d41
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

0102019fda59be16-9db4d172-6d50-47af-a957-c2b22790d6bb-000000@mail12.docusign.net

Date

Fri, 7 Aug 2026 03:52:22 +0000

Subject

Anders Nordahl viewed Complete with Docusign: Azure WAF Implementation.docx

Content-Type

multipart/alternative; boundary="=-Jo30Y81+4uQKo5FoeZvSJA=="; charset=utf-8

Received

from SI2PR06CA0008.apcprd06.prod.outlook.com (2603:1096:4:186::23) by KUZPR04MB9515.apcprd04.prod.outlook.com (2603:1096:d10:c7::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.4; Fri, 7 Aug 2026 03:52:27 +0000

from OSA0EPF000000CD.apcprd02.prod.outlook.com (2603:1096:4:186:cafe::a7) by SI2PR06CA0008.outlook.office365.com (2603:1096:4:186::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.23 via Frontend Transport; Fri, 7 Aug 2026 03:52:26 +0000

from esa2.hc847-16.ap.iphmx.com (139.138.44.82) by OSA0EPF000000CD.mail.protection.outlook.com (10.167.240.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.6 via Frontend Transport; Fri, 7 Aug 2026 03:52:26 +0000

from a54-92.smtp-out.eu-west-1.amazonses.com ([54.240.54.92]) by esa2.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Aug 2026 20:52:24 -0700

Received-Spf

Fail (protection.outlook.com: domain of mail12.docusign.net does not designate 139.138.44.82 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.44.82; helo=esa2.hc847-16.ap.iphmx.com;

Pass (esa2.hc847-16.ap.iphmx.com: domain of 0102019fda59be16-9db4d172-6d50-47af-a957-c2b22790d6bb-000000@mail12.docusign.net designates 54.240.54.92 as permitted sender) identity=mailfrom; client-ip=54.240.54.92; receiver=esa2.hc847-16.ap.iphmx.com; envelope-from="0102019fda59be16-9db4d172-6d50-47af-a957-c2b22790d6bb-000000@mail12.docusign.net"; x-sender="0102019fda59be16-9db4d172-6d50-47af-a957-c2b22790d6bb-000000@mail12.docusign.net"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 -all"

Message-Id

<0102019fda59be16-9db4d172-6d50-47af-a957-c2b22790d6bb-000000@eu-west-1.amazonses.com>

Extracted URLs

  • file http://secure-web.cisco.com/15qeQBLZj1kJ1muHMz_dwspSK-2PFwhZeUzenIHJIwljl_3f1pAH4yn2k2e-BuhW9f2yZDXpwKvY2YzgCR3nBT25bKk9_XgZwKvOn_45VUM4tH6YpVccFKpcT_V4MNxvzC5nSvM9Aj_a3T0ebokXI3Y-T-DRcT_iCGrx5MUD97KazKe8H4cD4IfHZhpuTFH1L8Di8-yVqyfKulIMGCEVwJXEcAyDpwbbj8GmbVKyiVTJt6AYzu8kR0lOBiGEGuE5l7-fAQ3KpiYoi1Xdspk1Kif4EGWtmX_y2CdCSiuakeC2CJ7cCSLbmKL1ivxGeDTmBGrz1AeO5keXyUrJNJslJl_1uNxImHVdD41IsIuj5LdW6onRMbxTGkonNPoYZHtLbAmFuAxd7Uk6dLuz91QLRFrA6WyPWqLDd6v9EGLSctQgtDlJcpPKz-_-Lsbq9dtGA/l544%3Ahttps%3A%2F%2Fprotect.docusign.net%2Freport-abuse%3Fe%3DAUtomjpFak9GlbPL0zFFi11y55ZoxF58Fc-X4hGrdtreSCF_8xHhOKk9u9BjYNnlT3cQFhoVucAAJ7JQDBaW7OCbckZ9Nix8tg7gAPeR1N3nVSGVHDCNBJjG7NYSZZ_wpwE6hSCQw4YjbXHYefrzmiJ8SjswD7jvDgogLBGcmza7EpdhaWs3z2xxzcTFo70v420akujRz7SXgU1pIog8Yhmg3wYs0M0aQK1ouTfJUoGd1p-NgPS5zvb80cFgzHBbJgA1wsT0wEXjClqAnl4eDDAjigleJR3c4dMDBPxEqOi5L2adukWfYT_B_UaZ3f9HOAmxmee39MIjyxT1onP1K6f3GjJU8PP0TYM4ogxHpjIyU6mK0huH94lwNSfcdzPsjse9WizdqbVAEsl_3lYjJkX83TpQJ4n4UY_8rK5K0OasO1Qe5q-Rpui-i1OeQJdhtyxE5B_R2AL9CyRjseQcDY4G3aXC4a7Cr8g7n-_RNMSf%26lang%3Dene

  • file http://secure-web.cisco.com/15qeQBLZj1kJ1muHMz_dwspSK-2PFwhZeUzenIHJIwljl_3f1pAH4yn2k2e-BuhW9f2yZDXpwKvY2YzgCR3nBT25bKk9_XgZwKvOn_45VUM4tH6YpVccFKpcT_V4MNxvzC5nSvM9Aj_a3T0ebokXI3Y-T-DRcT_iCGrx5MUD97KazKe8H4cD4IfHZhpuTFH1L8Di8-yVqyfKulIMGCEVwJXEcAyDpwbbj8GmbVKyiVTJt6AYzu8kR0lOBiGEGuE5l7-fAQ3KpiYoi1Xdspk1Kif4EGWtmX_y2CdCSiuakeC2CJ7cCSLbmKL1ivxGeDTmBGrz1AeO5keXyUrJNJslJl_1uNxImHVdD41IsIuj5LdW6onRMbxTGkonNPoYZHtLbAmFuAxd7Uk6dLuz91QLRFrA6WyPWqLDd6v9EGLSctQgtDlJcpPKz-_-Lsbq9dtGA/l544:

  • file http://secure-web.cisco.com/1nYowipZrYRQBaU-PKSR707jq21q3q7vDYHldlvro15l5T768TMsVWM1xwwe-QUXfFHUR8dhe-eNCLSy3VdOgHRHYBr1_vvWcKSVDawvgmGMtcXdOe-pw_gw0t9XgDqsUolIXAwSdKgS8gzwNpegk8qNYb3WVm64cXOx2c7pOAbyezbpejz6q7hn_B01P6C7D-dGpiW2cf4HwKQYDqKySLNra5D66Go4czalbVIH1R5koAZ0lA-cfDJc9ZbpjiMnOekbsG1v9Ow6diEG70s7crfhysPKsXrLjdaxUE5KfQ11pWF0SnaLk9-kzrCoAx1zbyI2ECGyyxr-E_kCD88HYyIX8stYpwIpVI8jF_C4C3tdbaZSXI_Ko9HNEOdtigajpUpO1KBlTr-xYhgcBFf7iGq7yi1I3k3tNasrYvJLOuRVsYy92KOf9XW7ljVcfkwAW/l60%3Ahttps%3A%2F%2Fsupport.docusign.com%2Fs%2FcontactSupport%3Flanguage%3Den_USe

  • file http://secure-web.cisco.com/1wM8C1gkogqCwuc_CMHKy78uMqmGGH4bHNqYs9ZXqB1jneVNYv4vy4W8O3fwsEHgtrEAmB0g34mkOo5aKIzCBQUwMJYgUMKYL0ptJYypVuLXkGYKefhcDy9DIYkJbHD75l297vdsRy2j1eggR1qAg8MlUDESBolN8qUJ0_FRM-tI7YrAVH6ISz_ycnTz0s0RvAVeBAflJA-4NAIHXuTAGe9rMjjUVeWKx3PrJ3zEwCqW9xpAJ7Q3yWZSKCHcCFFP_ZAQPBurPOGWAlVqS5-QtJxQwS6uLAc8FmgzGkrQoYaVFRMzQMUfBRVbCVXmLPNkj4ekenS739klYvIqKy9LysUlreiOzxnNyp_w0fke1lXZXYjY2az-3hRX_Q6wo6ehkTQsRirI6wl8YW6ybEvQKKfq4XOuIrBT9xqD_y8EDn4116UMFgLDIidZBnvyj7erG/l60%3Ahttps%3A%2F%2Fsupport.docusign.com%2Fs%2FcontactSupport%3Flanguage%3Den_US544%3Ahttps%3A%2F%2Fprotect.docusign.net%2Freport-abuse%3Fe%3DAUtomjpFak9GlbPL0zFFi11y55ZoxF58Fc-X4hGrdtreSCF_8xHhOKk9u9BjYNnlT3cQFhoVucAAJ7JQDBaW7OCbckZ9Nix8tg7gAPeR1N3nVSGVHDCNBJjG7NYSZZ_wpwE6hSCQw4YjbXHYefrzmiJ8SjswD7jvDgogLBGcmza7EpdhaWs3z2xxzcTFo70v420akujRz7SXgU1pIog8Yhmg3wYs0M0aQK1ouTfJUoGd1p-NgPS5zvb80cFgzHBbJgA1wsT0wEXjClqAnl4eDDAjigleJR3c4dMDBPxEqOi5L2adukWfYT_B_UaZ3f9HOAmxmee39MIjyxT1onP1K6f3GjJU8PP0TYM4ogxHpjIyU6mK0huH94lwNSfcdzPsjse9WizdqbVAEsl_3lYjJkX83TpQJ4n4UY_8rK5K0OasO1Qe5q-Rpui-i1OeQJdhtyxE5B_R2AL9CyRjseQcDY4G3aXC4a7Cr8g7n-_RNMSf%26lang%3Dene

  • file http://secure-web.cisco.com/1wM8C1gkogqCwuc_CMHKy78uMqmGGH4bHNqYs9ZXqB1jneVNYv4vy4W8O3fwsEHgtrEAmB0g34mkOo5aKIzCBQUwMJYgUMKYL0ptJYypVuLXkGYKefhcDy9DIYkJbHD75l297vdsRy2j1eggR1qAg8MlUDESBolN8qUJ0_FRM-tI7YrAVH6ISz_ycnTz0s0RvAVeBAflJA-4NAIHXuTAGe9rMjjUVeWKx3PrJ3zEwCqW9xpAJ7Q3yWZSKCHcCFFP_ZAQPBurPOGWAlVqS5-QtJxQwS6uLAc8FmgzGkrQoYaVFRMzQMUfBRVbCVXmLPNkj4ekenS739klYvIqKy9LysUlreiOzxnNyp_w0fke1lXZXYjY2az-3hRX_Q6wo6ehkTQsRirI6wl8YW6ybEvQKKfq4XOuIrBT9xqD_y8EDn4116UMFgLDIidZBnvyj7erG/l60:

  • file https://eu.docusign.net/Member/EmailStart.aspx?etti=67&m=71336906-6b8e-8317-83f5-e3bd1888b69b

  • file https://support.docusign.com/

  • file https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&#38;utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&%2338;utm_medium=product&%2338;utm_source=postsend

  • file https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend

  • Show all