Potential Phish (44[.]5 KB)[.]msg

Sharing

Copy URL Twitter E-mail

General

Target
Potential Phish (44.5 KB).msg
Size 62KB
Sample261022-sb53fsc191
SHA256 f33c00c3448d2b49af1646f2d0739108e9337558ad7be87b8ab60ce767123625
MD5 b44b2f3cb30f7b4d41c1fb5dc9694de4
SHA1 4dc574931bed68351411a0c63457266988851b5b
SHA512 42eaad7db0d69e5f83993f745dd582c182ef5b2871646fe8c3f3c5d9c456a0c803ba749ae51ae7ace225684d1e5d61ecba3cd0e57d263f91c28284d3272bd713
SSDEEP 768:Txomr8M5zkLDBTWfALNEFk82Zbx9JR1YhDNhaquWkK0gE+kGNwFo4wnJi9EM87:Lr8MNkXBTWALN182Zbx9h+l6lwcCn
TLSH
T1FA53C0242AFA0219F173AF769EF660539977BD52AD35990D10C5330A07B3E40E962F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Potential Phish (44.5 KB).msg

.msg 62KB

Potential Phish (44.5 KB).msg

SHA256 f33c00c3448d2b49af1646f2d0739108e9337558ad7be87b8ab60ce767123625
MD5 b44b2f3cb30f7b4d41c1fb5dc9694de4
SHA1 4dc574931bed68351411a0c63457266988851b5b
SHA512 42eaad7db0d69e5f83993f745dd582c182ef5b2871646fe8c3f3c5d9c456a0c803ba749ae51ae7ace225684d1e5d61ecba3cd0e57d263f91c28284d3272bd713
SSDEEP 768:Txomr8M5zkLDBTWfALNEFk82Zbx9JR1YhDNhaquWkK0gE+kGNwFo4wnJi9EM87:Lr8MNkXBTWALN182Zbx9h+l6lwcCn
TLSH
T1FA53C0242AFA0219F173AF769EF660539977BD52AD35990D10C5330A07B3E40E962F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Delivered-To

From

Reply-To

Return-Path

emily_white+[email protected]

Date

Tue, 20 Oct 2026 18:27:56 +0000

Subject

Share request for "AKS 11 Central Idea & Types of Evidence, Facing the Flames.docx"

Content-Type

multipart/alternative; boundary="===============1578767948286019784=="

Received

from LV2PR04MB993998.namprd04.prod.outlook.com (2603:10b6:408:36f::23) by BN7PR04MB3844.namprd04.prod.outlook.com with HTTPS; Tue, 20 Oct 2026 18:28:06 +0000

from LV3P220CA0006.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:234::9) by LV2PR04MB993998.namprd04.prod.outlook.com (2603:10b6:408:36f::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 18:28:02 +0000

from BN3PEPF00022BC4.namprd05.prod.outlook.com (2603:10b6:408:234:cafe::9b) by LV3P220CA0006.outlook.office365.com (2603:10b6:408:234::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Tue, 20 Oct 2026 18:28:02 +0000

from mx0a-00332601.pphosted.com (148.163.133.252) by BN3PEPF00022BC4.mail.protection.outlook.com (10.167.248.216) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 18:28:01 +0000

from pps.filterd (m0280862.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69KGtwZA3655207 for <[email protected]>; Tue, 20 Oct 2026 18:28:00 GMT

from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hdw65ak6s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Tue, 20 Oct 2026 18:28:00 +0000 (GMT)

by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2e8fe8e343fso19296115ad.2 for <[email protected]>; Tue, 20 Oct 2026 11:28:00 -0700 (PDT)

by 2002:a17:522:f98a:b0:68a:16a1:2092 with SMTP id mc10csp1601232pvb; Tue, 20 Oct 2026 11:27:57 -0700 (PDT)

from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id 00721157ae682-8b13155e530sor215377b3.0.2026.10.20.11.27.56 for <[email protected]> (Google Transport Security); Tue, 20 Oct 2026 11:27:57 -0700 (PDT)

X-Received

by 2002:a17:90a:10f:b0:3ad:1b31:92d8 with SMTP id 98e67ed59e1d1-3ad1b31933fmr4557008a91.60.1792520879699; Tue, 20 Oct 2026 11:27:59 -0700 (PDT)

by 2002:a05:690c:c509:b0:8a8:6fac:21af with SMTP id 00721157ae682-8b0f213fbfbmr50453217b3.12.1792520877037; Tue, 20 Oct 2026 11:27:57 -0700 (PDT)

by 2002:a05:690e:4009:b0:679:a047:e279 with SMTP id 956f58d0204a3-67a0e45b8eamr43751d50.37.1792520876481; Tue, 20 Oct 2026 11:27:56 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of g.gcpsk12.org designates 148.163.133.252 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.133.252; helo=mx0a-00332601.pphosted.com; pr=C

pass (google.com: domain of 3rllxahckam0wa1ex-b0taxb-w5-67ax84hz77z4x.v75@doclist.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;

Message-Id

<[email protected]>

Extracted URLs

file http://g.gcpsk12.org
file https://docs.google.com/document/d/1_f7cUg1gtg2Mv94zO76-2Lg8QgolHi6H/edit?usp=sharing_esl&rtpof=true&sd=true&[email protected]&sharingaction=manageaccess&role=writer&ts=6ad7b2ac
file https://docs.google.com/document/d/1_f7cUg1gtg2Mv94zO76-2Lg8QgolHi6H/edit?usp=sharing_esl&rtpof=true&sd=true&[email protected]&sharingaction=manageaccess&role=writer&ts=6ad7b2ac
file https://docs.google.com/document/d/1_f7cUg1gtg2Mv94zO76-2Lg8QgolHi6H/edit?usp=sharing_esp&rtpof=true&sd=true&[email protected]&sharingaction=manageaccess&role=writer&ts=6ad7b2ac
file https://docs.google.com/document/d/1_f7cUg1gtg2Mv94zO76-2Lg8QgolHi6H/edit?usp=sharing_esp&rtpof=true&sd=true&[email protected]&sharingaction=manageaccess&role=writer&ts=6ad7b2ac
file https://lh3.googleusercontent.com/a/ACg8ocIQEOx80eJTfiLDV_OuszYxSjm62DEH7nGYswU70JmNSf5RqQ=s64
file https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_word_x64.png
file https://workspace.google.com
file https://www.gstatic.com/docs/documents/share/images/googleworkspace_logo_192x80.png