Resubmissions

03/09/2026, 18:39

260903-xa1hsstema1

03/09/2026, 18:36

260903-w9dmmsdq9t1

03/09/2026, 18:33

260903-w7msjazwas1

General

  • Target
    suspected_phishing_email (21).eml
  • Size 24KB
  • Sample260903-xa1hsstema
  • SHA256 de6fbd8d94d3a0093604fc7658cb88b9ae5198df5a8f8dcef414cd755dc3ad65
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • suspected_phishing_email (21).eml
    .eml 24KB
  • email-html-1.txt
    .html 10KB

suspected_phishing_email (21).eml

  • SHA256 de6fbd8d94d3a0093604fc7658cb88b9ae5198df5a8f8dcef414cd755dc3ad65
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Reply-To

IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=f394418daf06453fa7a48eaa3b19b252-Michael@namprd20.prod.outlook.com

Return-Path

[email protected]

Date

Thu, 03 Sep 2026 17:02:49 GMT

Thu, 3 Sep 2026 16:56:07 +0000

Subject

RE: RFQ68453 - KL Construction Company

RE: RFQ68453 - KL Construction Company

Content-Type

text/html; charset=UTF-8

Received

from CH3PR15MB5841.namprd15.prod.outlook.com (2603:10b6:610:121::15) by CH5PR15MB6969.namprd15.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 17:02:48 +0000

from SA1P222CA0103.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:3c5::7) by CH3PR15MB5841.namprd15.prod.outlook.com (2603:10b6:610:121::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Thu, 3 Sep 2026 16:56:35 +0000

from SN1PEPF00036F40.namprd05.prod.outlook.com (2603:10b6:806:3c5:cafe::83) by SA1P222CA0103.outlook.office365.com (2603:10b6:806:3c5::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 16:56:35 +0000

from PH8PR06CU001.outbound.protection.outlook.com (2a01:111:f403:c107::1) by SN1PEPF00036F40.mail.protection.outlook.com (2603:10b6:80f:fc04::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 16:56:34 +0000

from DM4PR20MB4824.namprd20.prod.outlook.com (2603:10b6:8:a6::14) by MN0PR20MB4861.namprd20.prod.outlook.com (2603:10b6:208:3c3::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 16:56:07 +0000

from DM4PR20MB4824.namprd20.prod.outlook.com ([fe80::ffc3:6e58:1f7b:925e]) by DM4PR20MB4824.namprd20.prod.outlook.com ([fe80::ffc3:6e58:1f7b:925e%5]) with mapi id 15.21.0360.008; Thu, 3 Sep 2026 16:56:07 +0000

Received-Spf

Pass (protection.outlook.com: domain of klmasters.com designates 2a01:111:f403:c107::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c107::1; helo=PH8PR06CU001.outbound.protection.outlook.com; pr=C

Message-Id

<DM4PR20MB4824B0A8EBA29E213841231DC5B62@DM4PR20MB4824.namprd20.prod.outlook.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://klmasters-my.sharepoint.com/:f:/p/raraya/IgDpFcSXdW1eQKqqGZCHucj7AWp88LVMZ3t5tkZcGSh01GI?e=gickmU&xsdata=MDV8MDJ8a3JlZ2llckBpbnRlcm5hdGlvbmFscGlwZS5jb218ZjZiYWNhY2Y2YTMyNDE1ZWEzY2YwOGRmMDlkYzRmZWR8ZmMxZWZmMmIwOWM1NGMwOGE4OTg5YTZkNmE1ZDNmZjF8MHwwfDYzOTI0MDUxNzY4ODc1NzAxMXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18NjAwMDB8fHw%3d&sdata=UVRWamF4RmZhN1FFNyt0cGRtcXpzWFhTTmxNQUt2bEFtMEdnNWJCc05Lcz0%3d