Static

static

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (80.9 KB).msg
  • Size 104KB
  • Sample261022-vql91ady81
  • SHA256 db54749fe446025d2aafaa955f66183f8ea04484b1e43e2f8ee47827535fc689
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (80.9 KB).msg
    .msg 104KB

Potential Phish (80.9 KB).msg

  • SHA256 db54749fe446025d2aafaa955f66183f8ea04484b1e43e2f8ee47827535fc689
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 22 Oct 2026 16:00:56 +0000

Subject

Ends tomorrow: Save 25% on the Docusign plan that's right for you

Content-Type

multipart/alternative; boundary="===============7284165908509943138=="

Received

from PH8PR04MB9930.namprd04.prod.outlook.com (2603:10b6:510:3a9::22) by DM6PR04MB4953.namprd04.prod.outlook.com with HTTPS; Thu, 22 Oct 2026 16:01:03 +0000

from DM6PR07CA0117.namprd07.prod.outlook.com (2603:10b6:5:330::32) by PH8PR04MB9930.namprd04.prod.outlook.com (2603:10b6:510:3a9::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Thu, 22 Oct 2026 16:01:00 +0000

from BL6PEPF00022570.namprd02.prod.outlook.com (2603:10b6:5:330:cafe::4) by DM6PR07CA0117.outlook.office365.com (2603:10b6:5:330::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.16 via Frontend Transport; Thu, 22 Oct 2026 16:01:00 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by BL6PEPF00022570.mail.protection.outlook.com (10.167.249.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Thu, 22 Oct 2026 16:00:59 +0000

from pps.filterd (m0266390.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69MED962967211 for <[email protected]>; Thu, 22 Oct 2026 16:00:58 GMT

from mta-70-22-37.sparkpostmail.com (mta-70-22-37.sparkpostmail.com [156.70.22.37]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hf9hw9scy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Thu, 22 Oct 2026 16:00:58 +0000 (GMT)

from [10.90.20.250] ([10.90.20.250]) by i-0488a24b5e25c44af.mta1vrest.sd.prd.sparkpost (ecelerity 5.3.0.76509 r(msys-ecelerity:tags/5.3.0.26)) with REST id 84/E5-24623-8333ADA6; Thu, 22 Oct 2026 16:00:56 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning bounces.docusign.com discourages use of 148.163.137.252 as permitted sender)

Message-Id

<84.E5.24623.8333ADA6@i-0488a24b5e25c44af.mta1vrest.sd.prd.sparkpost>

Extracted URLs

  • file http://links1.docusign.com/q/373YmN7xh26yN_HmBawzOg~~/AARGbBA~/t-mTq1m2xAZyLUCwpK100-xfwGWtFh86cOf_xy_5Rdua-HDGWDiv2LhvFvZdtAZ-a4lywPuqO_zVuysfH-ywfw~~

  • file http://links1.docusign.com/q/BWxpqRcN6CIsylmOQ66DWg~~/AARGbBA~/pvMXqmwt5kSfe1mYeJCTmHPQvMPfhU5vq9sPnGys63iBeF7HoGeaUDkIAj580mfCw15km5saO6DMHZuN8aPLbA~~

  • file http://www.docusign.com

  • file https://assets.knak.io/custom-fonts/HelveticaNeue/HelveticaNeue.css

  • file https://assets.knak.io/custom-fonts/HelveticaNeue/HelveticaNeue.css%29;%7D

  • file https://assets.knak.io/img/icons/builder-social/facebook.png

  • file https://assets.knak.io/img/icons/builder-social/instagram.png

  • file https://assets.knak.io/img/icons/builder-social/linkedin.png

  • file https://assets.knak.io/img/icons/builder-social/twitter-x.png

  • Show all