Overview

overview

3

Static

static

1

Special In...ss.msg

windows10-2004-x64

3

Special In...ss.msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Special Invite FYI Use LaptopPc for easy access.msg
  • Size 152KB
  • Sample261002-s5fdwsvcpd
  • SHA256 960013a65c0c7dcb7912fd2fee5317e63105048db07e74506ad4a3f3de879529
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Special Invite FYI Use LaptopPc for easy access.msg
    .msg 152KB

Special Invite FYI Use LaptopPc for easy access.msg

  • SHA256 960013a65c0c7dcb7912fd2fee5317e63105048db07e74506ad4a3f3de879529
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 2 Oct 2026 08:09:40 -0700

Subject

Special Invite, FYI : Use Laptop/Pc for easy access

Content-Type

multipart/alternative; boundary="000000000000b8e419065cdcecbd"

Received

from MW4PR09MB9770.namprd09.prod.outlook.com (2603:10b6:303:1f2::9) by PH8PR09MB9438.namprd09.prod.outlook.com with HTTPS; Fri, 2 Oct 2026 15:10:18 +0000

from BL0PR0901CA0028.namprd09.prod.outlook.com (2603:10b6:208:1c0::38) by MW4PR09MB9770.namprd09.prod.outlook.com (2603:10b6:303:1f2::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.19; Fri, 2 Oct 2026 15:10:16 +0000

from BN5PEPF00047591.namprd09.prod.outlook.com (2603:10b6:208:1c0:cafe::6e) by BL0PR0901CA0028.outlook.office365.com (2603:10b6:208:1c0::38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.19 via Frontend Transport; Fri, 2 Oct 2026 15:10:14 +0000

from mail.wisconsin.gov (165.189.62.150) by BN5PEPF00047591.mail.protection.outlook.com (10.167.248.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Fri, 2 Oct 2026 15:10:14 +0000

from APWMIL0P6638.accounts.wistate.us (165.189.62.150) by APWMIL0P6638.accounts.wistate.us (165.189.62.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Fri, 2 Oct 2026 10:10:00 -0500

from SA9PR09CU002.outbound.protection.outlook.com (40.93.14.22) by APWMIL0P6638.accounts.wistate.us (165.189.62.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49 via Frontend Transport; Fri, 2 Oct 2026 10:10:00 -0500

from CYXPR09CA0014.namprd09.prod.outlook.com (2603:10b6:930:d4::26) by MW4PR09MB9677.namprd09.prod.outlook.com (2603:10b6:303:1ff::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.19; Fri, 2 Oct 2026 15:09:58 +0000

from SJ1PEPF000037B2.namprd09.prod.outlook.com (2603:10b6:930:d4::4) by CYXPR09CA0014.outlook.office365.com (2603:10b6:930:d4::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.19 via Frontend Transport; Fri, 2 Oct 2026 15:09:58 +0000

from meamad0p5157.wi.gov (165.189.88.237) by SJ1PEPF000037B2.mail.protection.outlook.com (10.167.242.134) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Fri, 2 Oct 2026 15:09:57 +0000

from mail-lf2-f12.google.com ([74.125.229.204]) by meamad0p5157.wi.gov with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 02 Oct 2026 10:09:57 -0500

by mail-lf2-f12.google.com with SMTP id 2adb3069b0e04-5ba3e27d525so2637098e87.1 for <[email protected]>; Fri, 02 Oct 2026 08:09:56 -0700 (PDT)

X-Received

by 2002:a05:6512:ba6:b0:5ba:3db3:698c with SMTP id 2adb3069b0e04-5bb9bc57c11mr1032643e87.57.1790953794363; Fri, 02 Oct 2026 08:09:54 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 165.189.62.150 as permitted sender)

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 165.189.88.237 as permitted sender)

Pass (meamad0p5157.wi.gov: domain of [email protected] designates 74.125.229.204 as permitted sender) identity=mailfrom; client-ip=74.125.229.204; receiver=meamad0p5157.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all"

None (meamad0p5157.wi.gov: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=74.125.229.204; receiver=meamad0p5157.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only

Message-Id

<CAM9gwBjp=L3NMi1qmjOx-tF-Q8F_rJpyaG56it4PCiMw30+[email protected]>

Extracted URLs

  • file http://secure-web.cisco.com/1agNvzlTmSydznzLzoViGNQcHslkLS0fEq13lc-iaBdUs40yLiluSAPdKZwJaSAuxFWIvj5zKdGUUK0BtcpEUtZMZxJsjnqIeC9xgf1fJkFiTyUFQ5deyosPEhpNukfNzpcskHsMHqobfuK34HbKRV2fyRkFJqGql6Z_j2Ikn8I_etnL7L-iVOAtmwyeMa0lu9Ih3YNYQ7RI88XZYXUH7Li5i16soLanf8NgPyk9dcgR6_vCPqVLr3OSXzam93zb8wub_lg8VqsXxOSTP427V2i_alrbUmU2I1sxjbpeh56j6XUXf5zjbDqd0yl3Pt1dv/http:/click.greenvelope.com/q/666Le289p60Y_Q0RJNepNQ~~/AACcaBA~/l9vlFgwK43vzwgJyyAWf4xug2-vMpcUXBDBfT7BcUuF3cyFdTCmkL0c6nETeoOeLE53ACpp_eGYwwtU7nK4ClA~~

  • file https://secure-web.cisco.com/1Zt7xpT1D8cphn3AOxkoxyZznE4VXu0iFon3bcyIRWXcqCoCMpkIoiYNkdqb26EIk3A2Dyrteg1rJ25MO2in8vmG8aYBWDGtGSrcAtKVKO1V17hQYWvyLmDK4ZO4xES5T8DYJbsHA0CCaaMKx4Z-_hqR0ppn55H4A_pGk5_ygfjNG0LzZ_qCchxUf2p9ZRVeVGASM3F9oCUSu0PenP8JvUg-zYqP0ptQ_kZQ_mg3ZGqEgRJ_bs5plWwXe_cKxisgRkYJkb8HOPdl5A_TdSiRzci2mXYg_hfYnyu2riq2ZG8G3lZuGt_QO_uKRPgTm2pLG/https:/abre.ai/s4cZ

  • file https://secure-web.cisco.com/1tkrNbo2RKGQNXI72jiKgd2cfNiaeduRXRW4kFqLF9uVSICReLy9wiziBu70GQEDpzVEemGpgtr4nnWbkk6cTcL0fLUwK62ZukBlNu2uBSR9BAGYOaJYcfqP96vPiD9sLmxFdCJqaXt291G0sUhqDQomY6hPl2UA5C5pjwDtRWF6mKKKUXq23PxIJJDekgB_CXiKXg81NRITA54Hu1abIptd2xQH2gXOgEbxDAQlhJhStsd33W4-4OOqjPcMh2oqB9jR5zti7lGUBxoTh7gf3hz6xrawB4I-mg_xGRn3htDn7dPDOTy7aGfZl8USJFafu/https:/www.greenvelope.com/v.ashx%3Fcode=O3NRXDY&ga=0

  • file https://secure-web.cisco.com/1vuieqJY4d38FyJkfPP6UPWaA7pvasBWXsX-F4Cbn8hknCupxJvIaFQc4FvLcHksUU1lWjA_iXi3UPsaEbj1U6fGtvw0Fu-3m_rricRkORygOHMWl1AC4wwlGgcf9gGCm843HM1nN7bam37K151zbM_O8weK4T1rneb8ZHIztrweFMyKB9u-PQkfKD9OQ2MtK30thozliK0XEQyvbgzqjFLteV8uVi1M5kIHxLB9myniSHpJPzQngGnXDUXc8IPZLizSRj_1V2O10uCtjJDEzm7STB130qkMUke1uaFg3txZk6tJeVQAKmx4lfp5-SzMo/https:/www.greenvelope.com/pub/_images/email/greenvelope_textlogo.png