Message[.]eml | Triage™

General

Target
Message.eml
Size 2.0MB
Sample260922-vc8abaag89
SHA256 437a7dc6185409c84ef8ce18456a2f2d5c1b99ca78a113fe2bde92cd7426b169
MD5 6a0878615b1283de06bb52268dbe7034
SHA1 ca2de65d8735f05277dd72db92ad6df84a2683d3
SHA512 6a4adb386bba80b2e35698a6972aa127a340e4ea74b8eb7f523824dafe35193b52753c86d2fde0afd87d8e8d819baf0a912f9649d5fda1d4a27d6b2c1c4a37da
SSDEEP 24576:mRWbddLwAp6S1WZ2gkEd8Y3mFqGO7pyKSKKMekeqWaeh7JO/FVynuy5RD3ojJo0A:mcvvij8DXaA1VngUnJjzREsKA5g0cC
TLSH
T13DA52379850A77EF0D31A5F3B60EB494AC9C2AC7458B161317B8C57136BB0A8AF4FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Message.eml

.eml 2.0MB
message_v2.rpmsg

1.5MB

Message.eml

SHA256 437a7dc6185409c84ef8ce18456a2f2d5c1b99ca78a113fe2bde92cd7426b169
MD5 6a0878615b1283de06bb52268dbe7034
SHA1 ca2de65d8735f05277dd72db92ad6df84a2683d3
SHA512 6a4adb386bba80b2e35698a6972aa127a340e4ea74b8eb7f523824dafe35193b52753c86d2fde0afd87d8e8d819baf0a912f9649d5fda1d4a27d6b2c1c4a37da
SSDEEP 24576:mRWbddLwAp6S1WZ2gkEd8Y3mFqGO7pyKSKKMekeqWaeh7JO/FVynuy5RD3ojJo0A:mcvvij8DXaA1VngUnJjzREsKA5g0cC
TLSH
T13DA52379850A77EF0D31A5F3B60EB494AC9C2AC7458B161317B8C57136BB0A8AF4FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

DM6PR22MB188429ECBAA0305C82B73D53B8842@DM6PR22MB1884.namprd22.prod.outlook.com

Date

Mon, 21 Sep 2026 15:07:39 +0000

Subject

[EXTERNAL] DLP Law

Content-Type

multipart/mixed; boundary="_002_DM6PR22MB1884C040867E2C7FBC27B36FB8842DM6PR22MB1884namp_"

Received

from BY3PR03CA0019.namprd03.prod.outlook.com (2603:10b6:a03:39a::24) by DSWPR14MB958651.namprd14.prod.outlook.com (2603:10b6:8:3a1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + Transport Decrypted) id 15.21.428.16; Mon, 21 Sep 2026 15:08:20 +0000

from MWH0EPF000A6735.namprd04.prod.outlook.com (2603:10b6:a03:39a:cafe::4) by BY3PR03CA0019.outlook.office365.com (2603:10b6:a03:39a::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Mon, 21 Sep 2026 15:08:20 +0000

from mx0b-0028ab01.pphosted.com (148.163.154.55) by MWH0EPF000A6735.mail.protection.outlook.com (10.167.249.27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Mon, 21 Sep 2026 15:08:19 +0000

from pps.filterd (m0337641.ppops.net [127.0.0.1]) by mx0a-0028ab01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68LF8I5Z339780 for <[email protected]>; Mon, 21 Sep 2026 10:08:18 -0500

from sj2pr03cu001.outbound.protection.outlook.com (mail-westusazon11022122.outbound.protection.outlook.com [52.101.43.122]) by mx0a-0028ab01.pphosted.com (PPS) with ESMTPS id 4gsq23cv5h-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=OK) for <[email protected]>; Mon, 21 Sep 2026 10:08:16 -0500 (CDT)

from DM6PR22MB1884.namprd22.prod.outlook.com (2603:10b6:5:253::15) by IA1PR22MB6095.namprd22.prod.outlook.com (2603:10b6:208:59e::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + Transport Decrypted) id 15.21.428.16; Mon, 21 Sep 2026 15:07:39 +0000

from DM6PR22MB1884.namprd22.prod.outlook.com ([fe80::78c1:4d27:c2cf:2e45]) by DM6PR22MB1884.namprd22.prod.outlook.com ([fe80::78c1:4d27:c2cf:2e45%6]) with mapi id 15.21.0428.015; Mon, 21 Sep 2026 15:07:39 +0000

Received-Spf

Fail (protection.outlook.com: domain of dlplaw.com does not designate 148.163.154.55 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.154.55; helo=mx0b-0028ab01.pphosted.com;

Message-Id

<DM6PR22MB1884C040867E2C7FBC27B36FB8842@DM6PR22MB1884.namprd22.prod.outlook.com>

Sharing