Overview

overview

4

Static

static

1

Potential ...B).msg

windows10-2004-x64

4

Potential ...B).msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (20.1 KB).msg
  • Size 47KB
  • Sample261014-seb9jset8l
  • SHA256 aaaf729447891a6c6054d91d9174fedf7158d1ca5b3fe3d89c8a9353178cc838
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (20.1 KB).msg
    .msg 47KB

Potential Phish (20.1 KB).msg

  • SHA256 aaaf729447891a6c6054d91d9174fedf7158d1ca5b3fe3d89c8a9353178cc838
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

Josephine Lee <[email protected]>

Return-Path

[email protected]

Date

Wed, 14 Oct 2026 05:15:06 -0600 (MDT)

Subject

PAID K-12 Staffing Survey

Content-Type

multipart/alternative; boundary="===============2883599349837411820=="

Received

from PH0PR04MB7702.namprd04.prod.outlook.com (2603:10b6:510:5d::20) by PH8PR04MB9988.namprd04.prod.outlook.com with HTTPS; Wed, 14 Oct 2026 11:15:11 +0000

from BN8PR04CA0038.namprd04.prod.outlook.com (2603:10b6:408:d4::12) by PH0PR04MB7702.namprd04.prod.outlook.com (2603:10b6:510:5d::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Wed, 14 Oct 2026 11:15:09 +0000

from BN7PEPF000000A3.namprd04.prod.outlook.com (2603:10b6:408:d4:cafe::89) by BN8PR04CA0038.outlook.office365.com (2603:10b6:408:d4::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Wed, 14 Oct 2026 11:15:09 +0000

from mx0a-00332601.pphosted.com (148.163.133.252) by BN7PEPF000000A3.mail.protection.outlook.com (10.167.248.155) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Wed, 14 Oct 2026 11:15:08 +0000

from pps.filterd (m0266389.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69EAqhC12148140 for <[email protected]>; Wed, 14 Oct 2026 11:15:07 GMT

from smtp-252-54.iad1.qemailserver.com (smtp-252-54.iad1.qemailserver.com [98.97.252.54]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4h9s861kd7-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Wed, 14 Oct 2026 11:15:07 +0000 (GMT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning oliverwyman.com discourages use of 148.163.133.252 as permitted sender)

Message-Id

<2108751292.977979.1791976506096@jwm-5d7874b877-xh927>

Extracted URLs

  • file https://j1.intellisurvey.com/pub/is0915608?pan=99

  • file https://j1.intellisurvey.com/pub/is0915608?pan=99&amp;trans_id=DNBU4KNCCW

  • file https://j1.intellisurvey.com/pub/is0915608?pan=99&trans_id=DNBU4KNCCW

  • file https://oliverwyman.co1.qualtrics.com/subscription/watermark.gif?UID=UR_43ignI3AlPmTJRQ&EMD=EMD_4Biq43T2I8JsmN4&CGC=CGC_bYAfZOFVw0hsq1F

  • file https://oliverwyman.co1.qualtrics.com/subscription/watermark.gif?UID=UR_43ignI3AlPmTJRQ&amp;EMD=EMD_4Biq43T2I8JsmN4&amp;CGC=CGC_bYAfZOFVw0hsq1F