General

  • Target
    uploads_2fd77bd8-9c49-4f06-8eaf-a3e8cf4852ae.eml
  • Size 69KB
  • Sample260916-tz73dsshne
  • SHA256 630a984809bc626a46ff5aab9866303f6312b3e9fa23f45c1c72cd14f373d87e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • SVG with JS event handler 1 IoCs
  • Suspicious SVG script tag 1 IoCs

File Explorer

  • uploads_2fd77bd8-9c49-4f06-8eaf-a3e8cf4852ae.eml
    .eml 69KB
  • LocalimageImage.png
    .png 10KB
  • MailedChecksAndStatementRequest.eml
    .eml 9KB
  • email-html-1.txt
    7KB
  • WNTQEEDP.HTM
    .svg .js 2KB
  • aG9tZQcHJvdmlzaW9uYWwZXh0cmEbWlja3Jvc29mdA.png
    .png 1KB
  • email-html-2.txt
    .html 8KB
  • email-plain-1.txt
    3KB

uploads_2fd77bd8-9c49-4f06-8eaf-a3e8cf4852ae.eml

  • SHA256 630a984809bc626a46ff5aab9866303f6312b3e9fa23f45c1c72cd14f373d87e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 16 Sep 2026 15:29:42 +0000

Subject

Content-Type

multipart/mixed; boundary="_008_6194af8915bc438284931d1f3c689cdbDS0PR09MB11571namprd09p_"

Received

from SJ0PR09MB11384.namprd09.prod.outlook.com (2603:10b6:a03:510::11) by BY5PR09MB4691.namprd09.prod.outlook.com with HTTPS; Wed, 16 Sep 2026 15:31:08 +0000

from CYXPR09CA0005.namprd09.prod.outlook.com (2603:10b6:930:d4::18) by SJ0PR09MB11384.namprd09.prod.outlook.com (2603:10b6:a03:510::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.11; Wed, 16 Sep 2026 15:31:00 +0000

from LV8PEPF00000061.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::10) by CYXPR09CA0005.outlook.office365.com (2603:10b6:930:d4::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Wed, 16 Sep 2026 15:31:00 +0000

from mail.wisconsin.gov (165.189.62.150) by LV8PEPF00000061.mail.protection.outlook.com (10.167.245.101) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 15:30:59 +0000

from APWMIL0P6638.accounts.wistate.us (165.189.62.150) by APWMIL0P6638.accounts.wistate.us (165.189.62.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Wed, 16 Sep 2026 10:30:33 -0500

from CH1PR09CU001.outbound.protection.outlook.com (40.93.20.31) by APWMIL0P6638.accounts.wistate.us (165.189.62.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49 via Frontend Transport; Wed, 16 Sep 2026 10:30:33 -0500

from CYXPR09CA0014.namprd09.prod.outlook.com (2603:10b6:930:d4::26) by SJ0PR09MB9224.namprd09.prod.outlook.com (2603:10b6:a03:465::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Wed, 16 Sep 2026 15:30:27 +0000

from BN7PEPF00000099.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::7d) by CYXPR09CA0014.outlook.office365.com (2603:10b6:930:d4::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Wed, 16 Sep 2026 15:30:27 +0000

from meamad0p5155.wi.gov (165.189.88.233) by BN7PEPF00000099.mail.protection.outlook.com (10.167.243.197) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 15:30:25 +0000

from mail-westusazlp17011011.outbound.protection.outlook.com (HELO BY5PR09CU001.outbound.protection.outlook.com) ([40.93.1.11]) by meamad0p5155.wi.gov with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 16 Sep 2026 10:30:19 -0500

from DS0PR09MB11571.namprd09.prod.outlook.com (2603:10b6:8:16d::14) by DM2PR09MB12275.namprd09.prod.outlook.com (2603:10b6:8:2ce::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Wed, 16 Sep 2026 15:30:14 +0000

from DS0PR09MB11571.namprd09.prod.outlook.com ([::1]) by DS0PR09MB11571.namprd09.prod.outlook.com ([fe80::fdd4:4eeb:933a:e225%4]) with Microsoft SMTP Server id 15.21.0428.008; Wed, 16 Sep 2026 15:30:14 +0000

Received-Spf

TempError (protection.outlook.com: error in processing during lookup of dot.wi.gov: DNS Timeout)

Pass (meamad0p5155.wi.gov: domain of [email protected] designates 40.93.1.11 as permitted sender) identity=helo; client-ip=40.93.1.11; receiver=meamad0p5155.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all"

Message-Id

<6194af8915bc438284931d1f3c689cdb@DS0PR09MB11571.namprd09.prod.outlook.com>

Extracted URLs

  • file https://secure-web.cisco.com/172It-xbYPOaJrIkQaga3rXyFXudTJ6_lSVpbNvLjuol0Uh3SLG7WmgPQ2KRoobUC8wNGWvLloEYBwuMOQAkC4_0LWbAapN_ezj-a41dBVODwkKjbn1-WEjx3objm_3TWZwjjn7djbrqpYyrXOuf5PXxHe9vHPdAp6LL9aWKmRsdQYgo0RWxbg2zV6gecVJEyZ5qG64v1wwlopXsfhc2w0emO9bo0IIsbFfB-iTTRcMfLbVZCLd6Om7KCAJ3TRbWsNfZk4RTV4vv6bWmqcjJMZQopcpwjLdMAt43eklKRHKp2wOuTrx1E63zbgET_Tafh/

  • file https://secure-web.cisco.com/1EMURiH_bS6NwL071-475B_y4vHmLIzGZu0s_YTUTUU3-i6BL26rq-U8yl22FBV7JwcYmfgmQqZfMubsUCQy24bkaHGUjxfouDdMl8VWffBwZKoEqHMivYbj6aabVmSTNE0h7wViMFzreI-6LDPFsFpt_Nk3_Z2E1VvpL5l24x0CTaGp6TBAzmcumCV8eyr_swN4jBVahUHW0lK9V_R5ei4H3avBrhLCD5E--_aYsCUW-WD7jXT8fd93FcUUE9Bl5leO6pSBYw_cenzHQSH4qN247WoTY3H-hY9vWQCLrtACIDcHpEFEf8UPalHoxcqvV/

  • file https://secure-web.cisco.com/1zfFYnJjP4QOE3gFR0c0XoCw8Tf7kFxLcm9UjhCkF2THGpqp2P366W0xkOLmN9bh-pnyjgg9PYFxOBJffvL-l9qdJTzKV2uISwPbWKdf0vkEXLyN7V4-wRp0uRaWq32KfRTFSPcEB2fQDi05oV1_yfro9paMPEvM0jT-oJt9N-_LQon90Q_6gkq3MaAuzUTp6yeEqPDzp-n9yveriuAt7xPqlVRBMgsgu3-A4-WtKM3T_2mLXMZsXfEcmz1QplqNUHa5WAifelRIz-u7993Ybb8Zqv49CroNqRh9kjZ_ct9YemzP7vgdsX0beWpE2-oix/

  • file https://secure-web.cisco.com/1zfFYnJjP4QOE3gFR0c0XoCw8Tf7kFxLcm9UjhCkF2THGpqp2P366W0xkOLmN9bh-pnyjgg9PYFxOBJffvL-l9qdJTzKV2uISwPbWKdf0vkEXLyN7V4-wRp0uRaWq32KfRTFSPcEB2fQDi05oV1_yfro9paMPEvM0jT-oJt9N-_LQon90Q_6gkq3MaAuzUTp6yeEqPDzp-n9yveriuAt7xPqlVRBMgsgu3-A4-WtKM3T_2mLXMZsXfEcmz1QplqNUHa5WAifelRIz-u7993Ybb8Zqv49CroNqRh9kjZ_ct9YemzP7vgdsX0beWpE2-oix/https:/www.linkedin.com/company/GoTo

  • file https://twitter.com/GoTo

  • file https://www.facebook.com/GoTo