Overview

overview

3

Static

static

1

eec8e2ac-9...11.eml

windows10-2004-x64

1

eec8e2ac-9...11.eml

windows11-ltsc_2024-x64

3

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

Resubmissions

10/09/2026, 20:13

260910-yzr4dsgl4w3

10/09/2026, 20:06

260910-yvf6bsee633

10/09/2026, 20:04

260910-ytbjfsgk8t3

10/09/2026, 16:34

260910-t268wasdrc3

Sharing

Copy URL Twitter E-mail

General

  • Target
    eec8e2ac-9e21-6e6d-a836-c99e1a00e511.eml
  • Size 126KB
  • Sample260910-t268wasdrc
  • SHA256 e49c14530491378beea1e034e8232445dd729d59bf947822cfeaf6f9a15a4315
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • eec8e2ac-9e21-6e6d-a836-c99e1a00e511.eml
    .eml 126KB
  • email-html-2.txt
    .html 65KB
  • email-plain-1.txt
    9KB

eec8e2ac-9e21-6e6d-a836-c99e1a00e511.eml

  • SHA256 e49c14530491378beea1e034e8232445dd729d59bf947822cfeaf6f9a15a4315
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
131233

Email Headers

Return-Path

010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000@info.gwinnetttaxicabsvc.com

Date

Thu, 10 Sep 2026 02:12:49 +0000

Subject

[MARKETING] Message update- KHSYYYA

Content-Type

multipart/alternative; boundary="--_NmP-94a4b4a491fe48dc-Part_1"

Received

from TY0PR04MB6519.apcprd04.prod.outlook.com (2603:1096:400:271::12) by TY0PR04MB6266.apcprd04.prod.outlook.com with HTTPS; Thu, 10 Sep 2026 02:17:10 +0000

from OS3P286CA0075.JPNP286.PROD.OUTLOOK.COM (2603:1096:604:201::18) by TY0PR04MB6519.apcprd04.prod.outlook.com (2603:1096:400:271::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.7; Thu, 10 Sep 2026 02:12:56 +0000

from OSA0EPF000000C9.apcprd02.prod.outlook.com (2603:1096:604:201:cafe::4b) by OS3P286CA0075.outlook.office365.com (2603:1096:604:201::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.9 via Frontend Transport; Thu, 10 Sep 2026 02:12:56 +0000

from esa2.hc847-16.ap.iphmx.com (139.138.44.82) by OSA0EPF000000C9.mail.protection.outlook.com (10.167.240.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Thu, 10 Sep 2026 02:12:55 +0000

from a8-93.smtp-out.amazonses.com ([54.240.8.93]) by esa2.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2026 19:12:56 -0700

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning info.gwinnetttaxicabsvc.com discourages use of 139.138.44.82 as permitted sender)

Pass (esa2.hc847-16.ap.iphmx.com: domain of 010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000@info.gwinnetttaxicabsvc.com designates 54.240.8.93 as permitted sender) identity=mailfrom; client-ip=54.240.8.93; receiver=esa2.hc847-16.ap.iphmx.com; envelope-from="010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000@info.gwinnetttaxicabsvc.com"; x-sender="010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000@info.gwinnetttaxicabsvc.com"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 ip4:98.77.0.0/16 -all"

Message-Id

<010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000@email.amazonses.com>

Extracted URLs

  • file http://secure-web.cisco.com/1uOQmfMbE-oG-NNoQp1HEhdLd9NcGN-6Xsm-5-nAGEcD3XMLNkoOAOBB7EtNhze6ICuP3CY_S3JKwlQ3L_QnPtjWcmJH6dPkkLSah0WNAcgSqRBfAYqsuBb7HexfbI-vSStOWZrcZuro_18Ei5ZOKKuAOrbAeuw_0x0cpmq23PnbBrIa4a9KS2fkWj8N2M99ADmJ-E4nCLVTEfWnrXMiMFgaE_S3vaDevOClgwVjQ9IRvEtn5uvJjyalrKSGB-ZhM53CHWHi964VuEF82CCEQ-7DRfxlnZ11_emIumhEdVwBsPT2EtD3P3CgdoAHGWXD0eZNl7StYnPyPXEGkT1UjKi2PGa8O15ddJ34UUynyyJsc6bhnsy-ls4VtPAMT1JApx5sE32flG1ZAj01E0UvMzMMT-y14lSuI1bO8RRQhhALRBrKayeAnLV1P1r3qLiSu/l432%3Ahttps%3A%2F%2Fs10mg5vm.r.us-east-1.awstrack.me%2FL0%2Fhttps%3A%252F%252Fwww.prophix.com%252Fpreference-center%252F%253Femail%3Ddlangone%2540dmdickason.com%2526elqTrackId%3D58c303d08ef44d8ca41dd7f6e8441661%2526elq%3Dbc0c6619c107492d8bfdbf4862f23564%2526elqaid%3D10747%2526elqat%3D1%2526elqCampaignId%3D25686%2526elqak%3D8AF5C8EF0DCF8F311B4336A98D170A40B8D6D1939FF1438BD82D4BD74923CC486E4F%2F1%2F010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000%2F2WTX-vzuTfYhTJFXVjJWgBm4bC0%3D473e

  • file http://secure-web.cisco.com/1uOQmfMbE-oG-NNoQp1HEhdLd9NcGN-6Xsm-5-nAGEcD3XMLNkoOAOBB7EtNhze6ICuP3CY_S3JKwlQ3L_QnPtjWcmJH6dPkkLSah0WNAcgSqRBfAYqsuBb7HexfbI-vSStOWZrcZuro_18Ei5ZOKKuAOrbAeuw_0x0cpmq23PnbBrIa4a9KS2fkWj8N2M99ADmJ-E4nCLVTEfWnrXMiMFgaE_S3vaDevOClgwVjQ9IRvEtn5uvJjyalrKSGB-ZhM53CHWHi964VuEF82CCEQ-7DRfxlnZ11_emIumhEdVwBsPT2EtD3P3CgdoAHGWXD0eZNl7StYnPyPXEGkT1UjKi2PGa8O15ddJ34UUynyyJsc6bhnsy-ls4VtPAMT1JApx5sE32flG1ZAj01E0UvMzMMT-y14lSuI1bO8RRQhhALRBrKayeAnLV1P1r3qLiSu/l432:

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://s10mg5vm.r.us-east-1.awstrack.me/I0/010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000/jFtBWp8ZlhyyNkSZVHOhLJN7QYY=473]

  • file https://s10mg5vm.r.us-east-1.awstrack.me/L0/

  • file https://s10mg5vm.r.us-east-1.awstrack.me/L0/https:%2F%2Fapp.demand.prophix.com%2Fe%2Fer%3Fs=1477570687%26lid=6347/1/010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000/p6_Z4y5YltRMtSGRwDKJyCKaq4E=473

  • file https://s10mg5vm.r.us-east-1.awstrack.me/L0/https:%2F%2Fapp.demand.prophix.com%2Fe%2Fer%3Fs=1477570687%26lid=7261%26elqTrackId=B691843CD88F854E16F57BED00FB755F%26elq=bc0c6619c107492d8bfdbf4862f23564%26elqaid=10747%26elqat=1%26elqak=8AF5B2A0A0FCC901F505369D3514A8D12A70D1939FF1438BD82D4BD74923CC486E4F/1/010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000/ba_Irs9rmT9SakFEfjdxcjeHSSI=473

  • file https://s10mg5vm.r.us-east-1.awstrack.me/L0/https:%2F%2Fapp.demand.prophix.com%2Fe%2Fer%3Fs=1477570687%26lid=7261/1/010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000/3rene1itfqtIm2o3a5fcTxZeDQw=473

  • file https://s10mg5vm.r.us-east-1.awstrack.me/L0/https:%2F%2Fapp.demand.prophix.com%2Fe%2Fer%3Fs=1477570687%26lid=8106/1/010001a08916d3f5-b951cbea-a913-4d8a-a9eb-51a60edb9c8d-000000/wl3iRQtWT-cvaHtSzme4DHomJXA=473

  • Show all