Overview

overview

6

Static

static

1

Message.eml

windows10-2004-x64

6

Message.eml

windows11-ltsc_2024-x64

6

email-html-2.html

windows10-2004-x64

6

email-html-2.html

windows11-ltsc_2024-x64

6

email-plain-1.html

windows10-2004-x64

6

email-plain-1.html

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 35KB
  • Sample261023-ws4gqsty3l
  • SHA256 022801c8c2f6a0b0db2f62b62a2cd6730531a55c02c9c03a904df587bf040b7a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 35KB
  • email-html-2.txt
    .html 12KB
  • email-plain-1.txt
    .html 10KB

Message.eml

  • SHA256 022801c8c2f6a0b0db2f62b62a2cd6730531a55c02c9c03a904df587bf040b7a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounces+49669673-94a4-miranda.lopez=tceq.texas.gov@em5234.sf-notifications.com

Date

Fri, 23 Oct 2026 16:05:30 +0000 (UTC)

Subject

Ashley Gonzalez has shared the folder 'TCEQ Solid Waste Audit Document Request October 2026' with you.

Content-Type

multipart/alternative; boundary="------------000205060903070003010308"

Received

from CH0P220CA0004.NAMP220.PROD.OUTLOOK.COM (2603:10b6:610:ef::10) by DM4PR13MB5881.namprd13.prod.outlook.com (2603:10b6:8:4c::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.17; Fri, 23 Oct 2026 16:05:32 +0000

from CH2PEPF00000143.namprd02.prod.outlook.com (2603:10b6:610:ef:cafe::16) by CH0P220CA0004.outlook.office365.com (2603:10b6:610:ef::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.16 via Frontend Transport; Fri, 23 Oct 2026 16:05:31 +0000

from o5.ptr6234.sf-notifications.com (167.89.16.230) by CH2PEPF00000143.mail.protection.outlook.com (10.167.244.100) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Fri, 23 Oct 2026 16:05:31 +0000

by recvd-569578f769-kqqg6 with SMTP id recvd-569578f769-kqqg6-1-6ADB85CA-8 2026-10-23 16:05:30.007208023 +0000 UTC m=+2070289.000017874

from us-smtprelay-mail.sharefile.io (unknown) by geopod-ismtpd-45 (SG) with ESMTP id W5B9jgwPST-eYjLcgL78bQ for <[email protected]>; Fri, 23 Oct 2026 16:05:29.986 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of em5234.sf-notifications.com designates 167.89.16.230 as permitted sender) receiver=protection.outlook.com; client-ip=167.89.16.230; helo=o5.ptr6234.sf-notifications.com; pr=C

Message-Id

<7CA12BC9323A19842F27E14C04514BDF4414B925@IP0AC106046>

Extracted URLs

  • file https://celanese-tx.sharefile.com/f/foe89dc7-5c1f-4e9f-b103-f245c4c308d5?a=ed9851f473680031

  • file https://celanese-tx.sharefile.com/styles/images/5e845e2f-9a88-475d-a904-3eb7dd9075a0.png

  • file https://sf-assets.sharefile.com/notifications/v1/images/transparent.gif

  • file https://sf-assets.sharefile.com/notifications/v1/images/transparent.gif&quot;

  • file https://sharefile.com/support

  • file https://www.w3.org/1999/xhtml

  • file https://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd