Overview

overview

4

Static

static

1

Potential ...B).msg

windows10-2004-x64

4

Potential ...B).msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (44.2 KB).msg
  • Size 55KB
  • Sample261026-rf7w6sts2l
  • SHA256 ee27462b61c0292b0cd455c2545a891f074a10e17b791ba16f32edd3d2f05cac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (44.2 KB).msg
    .msg 55KB

Potential Phish (44.2 KB).msg

  • SHA256 ee27462b61c0292b0cd455c2545a891f074a10e17b791ba16f32edd3d2f05cac
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 4 Sep 2026 14:54:51 -0400 (EDT)

Subject

UPS Ship Notification, Tracking Number 1Z6VV8620375099107

Content-Type

multipart/alternative; boundary="===============6804610110686082007=="

Received

from PH0PR04MB10189.namprd04.prod.outlook.com (2603:10b6:510:3bb::12) by BYAPR04MB5270.namprd04.prod.outlook.com with HTTPS; Fri, 4 Sep 2026 18:54:57 +0000

from PH8P220CA0028.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:348::6) by PH0PR04MB10189.namprd04.prod.outlook.com (2603:10b6:510:3bb::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Fri, 4 Sep 2026 18:54:54 +0000

from SN1PEPF00036F3D.namprd05.prod.outlook.com (2603:10b6:510:348:cafe::a3) by PH8P220CA0028.outlook.office365.com (2603:10b6:510:348::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.13 via Frontend Transport; Fri, 4 Sep 2026 18:54:54 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by SN1PEPF00036F3D.mail.protection.outlook.com (10.167.248.21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Fri, 4 Sep 2026 18:54:54 +0000

from pps.filterd (m0280861.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 684IXIMB2335400 for <[email protected]>; Fri, 4 Sep 2026 18:54:54 GMT

from mx0b-002b8002.pphosted.com (mx0b-002b8002.pphosted.com [148.163.140.227]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4gfhqnb84r-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 04 Sep 2026 18:54:53 +0000 (GMT)

from pps.filterd (m0425506.ppops.net [127.0.0.1]) by mx0a-002b8002.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 684IomMZ2005903 for <[email protected]>; Fri, 4 Sep 2026 14:54:53 -0400

from gappsappsagent3.ups.com (gappsappsagent3.ups.com [153.2.235.19]) by mx0a-002b8002.pphosted.com (PPS) with ESMTPS id 4gcgcfd5md-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 04 Sep 2026 14:54:53 -0400 (EDT)

from pps.filterd (gappsappsagent3.ups.com [127.0.0.1]) by gappsappsagent3.ups.com (8.18.1.2/8.18.1.2) with ESMTP id 684Hfitg020799 for <[email protected]>; Fri, 4 Sep 2026 14:54:52 -0400

from nscore-56897f7bc9-brjmv (lsvrocpp40106.linux.us.ups.com [10.127.129.169]) by gappsappsagent3.ups.com (PPS) with ESMTPS id 4gccv8gt46-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Fri, 04 Sep 2026 14:54:52 -0400

Received-Spf

Fail (protection.outlook.com: domain of ups.com does not designate 148.163.137.252 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.137.252; helo=mx0b-00332601.pphosted.com;

Message-Id

<1118071286.3234171.1788548091954.JavaMail.1001@winsmtpappspp.ups.com>

Extracted URLs

  • file http://Outlook.com

  • file http://td.call

  • file http://www.ups.com/img/1.gif

  • file http://www.ups.com/request

  • file http://www.ups.com/request/definition

  • file http://xml.apache.org/xalan/java

  • file https://unitedparcelservice.sc.omtrdc.net/b/ss/upsprod/1?AQB=1&amp;v14=%2F&amp;v49=email_rpt.ups.com&amp;pgf_Site=Country&amp;c6=US&amp;c5=en&amp;v56=09042026&amp;ch=E-mail+Template&amp;c33=Quantum+View+Notify&amp;c1=ct1_eml_qvn_eml_5shp&amp;v57=1788548091950&amp;pe=lnk_o&amp;pev2=E-mail+Template&amp;AQE=1

  • file https://unitedparcelservice.sc.omtrdc.net/b/ss/upsprod/1?AQB=1&v14=%2F&v49=email_rpt.ups.com&pgf_Site=Country&c6=US&c5=en&v56=09042026&ch=E-mail+Template&c33=Quantum+View+Notify&c1=ct1_eml_qvn_eml_5shp&v57=1788548091950&pe=lnk_o&pev2=E-mail+Template&AQE=1

  • file https://www.ups.com/assets/resources/images/UPS_logo_sm.png

  • Show all