General

  • Target
    uploads_02d9f6bd-961e-408d-8f65-aa9238eca96c.eml
  • Size 39KB
  • Sample261020-tjee5ss18m
  • SHA256 6a7ba3d3e40851915b6464ed9de20a1c87e3f47caf766d41fbaa9ad627ae1272
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • uploads_02d9f6bd-961e-408d-8f65-aa9238eca96c.eml
    .eml 39KB
  • email-html-1.txt
    .html 10KB

uploads_02d9f6bd-961e-408d-8f65-aa9238eca96c.eml

  • SHA256 6a7ba3d3e40851915b6464ed9de20a1c87e3f47caf766d41fbaa9ad627ae1272
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 20 Oct 2026 15:37:54 +0000

Subject

A Customer Has Submitted Feedback About Your Service

Content-Type

text/html; charset="utf-8"

Received

from SA1PR09MB11001.namprd09.prod.outlook.com (2603:10b6:806:364::17) by BLAPR09MB7202.namprd09.prod.outlook.com with HTTPS; Tue, 20 Oct 2026 15:38:24 +0000

from BL0PR0901CA0001.namprd09.prod.outlook.com (2603:10b6:208:1c0::11) by SA1PR09MB11001.namprd09.prod.outlook.com (2603:10b6:806:364::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 15:38:21 +0000

from BN7PEPF0000009B.namprd09.prod.outlook.com (2603:10b6:208:1c0:cafe::98) by BL0PR0901CA0001.outlook.office365.com (2603:10b6:208:1c0::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 15:38:21 +0000

from mail.wisconsin.gov (165.189.205.20) by BN7PEPF0000009B.mail.protection.outlook.com (10.167.243.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 15:38:21 +0000

from APWMAD0P6574.accounts.wistate.us (165.189.205.20) by APWMAD0P6574.accounts.wistate.us (165.189.205.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.56; Tue, 20 Oct 2026 10:38:21 -0500

from CO1PR09CU001.outbound.protection.outlook.com (40.93.10.7) by APWMAD0P6574.accounts.wistate.us (165.189.205.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.56 via Frontend Transport; Tue, 20 Oct 2026 10:38:21 -0500

from CY5PR09CA0025.namprd09.prod.outlook.com (2603:10b6:930:1::19) by MN2PR09MB4698.namprd09.prod.outlook.com (2603:10b6:208:210::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 15:38:18 +0000

from SJ1PEPF000037B3.namprd09.prod.outlook.com (2603:10b6:930:1:cafe::4c) by CY5PR09CA0025.outlook.office365.com (2603:10b6:930:1::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 15:38:18 +0000

from nwamad0p5652.wi.gov (165.189.56.61) by SJ1PEPF000037B3.mail.protection.outlook.com (10.167.242.135) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 15:38:18 +0000

from mta246b-ord.mtasv.net ([104.245.209.246]) by nwamad0p5652.wi.gov with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 20 Oct 2026 10:37:55 -0500

from ip-172-26-23-72.us-east-2.compute.internal (172.26.23.72) by production-pmta-useast2.internal.postmarkapp.com (KumoMTA 10.97.241.240) with ESMTP id 379b8aa9cc9c11f1b7ee02ffe6a7f0db for <[email protected]>; Tue, 20 Oct 2026 15:37:54 +0000

Received-Spf

Fail (protection.outlook.com: domain of pm-bounces.gpoil.asia does not designate 165.189.205.20 as permitted sender) receiver=protection.outlook.com; client-ip=165.189.205.20; helo=mail.wisconsin.gov;

Fail (protection.outlook.com: domain of pm-bounces.gpoil.asia does not designate 165.189.56.61 as permitted sender) receiver=protection.outlook.com; client-ip=165.189.56.61; helo=nwamad0p5652.wi.gov;

Pass (nwamad0p5652.wi.gov: domain of [email protected] designates 104.245.209.246 as permitted sender) identity=mailfrom; client-ip=104.245.209.246; receiver=nwamad0p5652.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:50.31.156.96/27 ip4:104.245.209.192/26 ip4:50.31.205.0/24 ip4:147.160.158.0/24 -all"

Pass (nwamad0p5652.wi.gov: domain of [email protected] designates 104.245.209.246 as permitted sender) identity=helo; client-ip=104.245.209.246; receiver=nwamad0p5652.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:50.31.156.96/27 ip4:104.245.209.192/26 ip4:50.31.205.0/24 ip4:147.160.158.0/24 -all"

Message-Id

<[email protected]>

Extracted URLs

  • file https://secure-web.cisco.com/1chPuzNWzrJxggEhTZ4JE_86YEhJyjYjZXWD3JYa-mw7UHuDEFEumrzUfOXz_dfhOga-4vJbRK3tv5iqC8Uk8ySJX1SBpRShgExu_ZMeqIP-WpLrwgAZtyugIsh003ShrMaTGK1ABES3Lx2izjiCFbdIBdUIpoB36K54zdSCEsMgY-v4a9ucj3MPrmfVgpdbXaEiW0vOumgOJ-OgiqhaSOU-eoaiaV7I801PuQkQnDTWj2PlkcoDP9sTaAwAu0MKp7WRE3H4qf68BxtJnsxr_xhiVbN1WKqbMB5akWmUaP43Cj7okW--mqRxvHfihp5lB/https:/track.pstmrk.it/3/agardepo.com.tr%2F/H51CAQ/CtnIAQ/AQ/dde1879a-25a7-425a-b257-62049b64bf56/1/hmMUOVwTDI