Overview

overview

4

Static

static

1

Message.eml

windows10-2004-x64

4

Message.eml

windows11-ltsc_2024-x64

1

ba821ae0-2...f1.png

windows10-2004-x64

1

ba821ae0-2...f1.png

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 29KB
  • Sample261002-s78s8avelf
  • SHA256 f54935df6e65cfc47932cd16b429dbcece2b4963ecf253a99d96e32ec49ed896
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 29KB
  • ba821ae0-29bb-435f-b9c2-b795c79fdbf1
    .png 3KB
  • email-html-1.txt
    .html 7KB

Message.eml

  • SHA256 f54935df6e65cfc47932cd16b429dbcece2b4963ecf253a99d96e32ec49ed896
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

SharePoint Online <[email protected]>

Return-Path

[email protected]

Date

Fri, 02 Oct 2026 14:51:57 +0000

Subject

Administrator has responded to your request for 'Virtual Field Trip'

Content-Type

multipart/related; boundary="=-vdaJg7CISXYkNbew4wxGQA=="; type="text/html"

Received

from SJ0PR05CA0166.namprd05.prod.outlook.com (2603:10b6:a03:339::21) by CH8PR13MB7242.namprd13.prod.outlook.com (2603:10b6:610:2bd::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.19; Fri, 2 Oct 2026 14:52:01 +0000

from CO1PEPF00012E7D.namprd03.prod.outlook.com (2603:10b6:a03:339:cafe::4f) by SJ0PR05CA0166.outlook.office365.com (2603:10b6:a03:339::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.6 via Frontend Transport; Fri, 2 Oct 2026 14:52:01 +0000

from BL0PR03CU003.outbound.protection.outlook.com (52.101.53.5) by CO1PEPF00012E7D.mail.protection.outlook.com (10.167.249.52) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Fri, 2 Oct 2026 14:52:00 +0000

from substrate.office.com (2603:10b6:a03:114::11) by DS7PR10MB5974.namprd10.prod.outlook.com with HTTP via BYAPR21CA0001.NAMPRD21.PROD.OUTLOOK.COM; Fri, 2 Oct 2026 14:51:57 +0000

Received-Spf

Pass (protection.outlook.com: domain of sharepointonline.com designates 52.101.53.5 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.53.5; helo=BL0PR03CU003.outbound.protection.outlook.com; pr=C

Message-Id

<SharingAccessResponse-3bc7a32a-90a1-4981-a690-eaf562be5163.rcid_69f440a2-c027-f000-d359-793ce4a1efa3.wiid_bde61cbe-b1f3-48fa-b185-04aeca017d1b.r0-ioe_1-tid_871a83a4-a1ce-4b7a-8156-3bcd93a08fba-rh_cae_notifyp-aid_75e327d6-2623-4021-9024-ceaf0aad6eaa@odspnotify>

Extracted URLs

  • file https://go.microsoft.com/fwlink/?LinkId=521839

  • file https://tceq-my.sharepoint.com/personal/megan_horton_tceq_texas_gov/Documents/Documents/Air%20Investigator%20Comittee/Virtual%20Field%20Trip.docx?d=w768a8d73a0be4adf85c06bb470ad2263&web=1&xsdata=MDV8MDJ8dmlja2llLm1jbGVhbkB0Y2VxLnRleGFzLmdvdnxlMTNiNDkzNzFlNDY0MDAyNmVkYzA4ZGYyMDk0YjcyMHw4NzFhODNhNGExY2U0YjdhODE1NjNiY2Q5M2EwOGZiYXwwfDB8NjM5MjY1NDk1NDk4NjkwNzM3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=bWdVejhhRUtWWklOMFk1Nm5EMEl5a1ZoSkk0S1dJSUtEcjNQaHhSTGVPdz0%3d