Overview

overview

3

Static

static

1

Potential ...B).msg

windows10-2004-x64

3

Potential ...B).msg

windows11-ltsc_2024-x64

1

image001.png

windows10-2004-x64

1

image001.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (51.7 KB).msg
  • Size 92KB
  • Sample261009-vr5sqsda67
  • SHA256 3df07814dbd62965c52493f505db4af03a2bac7261601495ec7cd0ec91d58798
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (51.7 KB).msg
    .msg 92KB
  • image001.png
    .png 20KB

Potential Phish (51.7 KB).msg

  • SHA256 3df07814dbd62965c52493f505db4af03a2bac7261601495ec7cd0ec91d58798
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

owner-dti-contracts*Donna*-Hudson**GCPSK12*[email protected]

Date

Fri, 9 Oct 2026 13:29:31 +0000

Subject

=?utf-8?q?Awareness_Notice=3A_Fraudulent_=E2=80=9CVendor_Digitizati?= =?utf-8?q?on_Compliance_Notice=E2=80=9D_Email?=

Content-Type

multipart/mixed; boundary="===============5877047897249478463=="

Received

from DS2PR04MB993848.namprd04.prod.outlook.com (2603:10b6:8:337::11) by BL3PR04MB8105.namprd04.prod.outlook.com with HTTPS; Fri, 9 Oct 2026 13:47:22 +0000

from SJ0PR03CA0180.namprd03.prod.outlook.com (2603:10b6:a03:338::35) by DS2PR04MB993848.namprd04.prod.outlook.com (2603:10b6:8:337::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.17; Fri, 9 Oct 2026 13:47:19 +0000

from SJ1PEPF000037AA.namprd03.prod.outlook.com (2603:10b6:a03:338:cafe::e) by SJ0PR03CA0180.outlook.office365.com (2603:10b6:a03:338::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Fri, 9 Oct 2026 13:47:19 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by SJ1PEPF000037AA.mail.protection.outlook.com (10.167.244.184) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Fri, 9 Oct 2026 13:47:18 +0000

from pps.filterd (m0280861.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 699DLGPC2062564 for <[email protected]>; Fri, 9 Oct 2026 13:47:18 GMT

from dtieusipo.state.de.us (dtieusipo.state.de.us [167.21.34.32]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4h70hu07sq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 09 Oct 2026 13:47:17 +0000 (GMT)

Received-Spf

PermError (protection.outlook.com: domain of listserv.delaware.gov used an invalid SPF mechanism)

Message-Id

<BY5PR09MB55377FF7D01369698FC1E3F490922@BY5PR09MB5537.namprd09.prod.outlook.com>

Extracted URLs

  • file http://DTI.Delaware.gov

  • file http://delaware.gov

  • file http://listserv.delaware.gov/cgi-bin/wa?A0=dti-contracts

  • file http://listserv.delaware.gov/cgi-bin/wa?TICKET=NzM5OTI4IERvbm5hLkh1ZHNvbkBHQ1BTSzEyLk9SRyBEVEktQ09OVFJBQ1RTIPe6fSClggWw&amp;c=SIGNOFF

  • file http://listserv.delaware.gov/cgi-bin/wa?TICKET=NzM5OTI4IERvbm5hLkh1ZHNvbkBHQ1BTSzEyLk9SRyBEVEktQ09OVFJBQ1RTIPe6fSClggWw&c=SIGNOFF

  • file https://dti.delaware.gov