Overview

overview

4

Static

static

1

Potential ...B).msg

windows10-2004-x64

4

Potential ...B).msg

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (24.6 KB).msg
  • Size 51KB
  • Sample261026-sdnaestv5n
  • SHA256 eddc7b5671d63ed57dd487569080b70168a4d1e70db32de90cf468c32492e080
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (24.6 KB).msg
    .msg 51KB

Potential Phish (24.6 KB).msg

  • SHA256 eddc7b5671d63ed57dd487569080b70168a4d1e70db32de90cf468c32492e080
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounces+[email protected]

Date

Fri, 23 Oct 2026 18:36:35 +0000 (UTC)

Subject

Are you willing to risk missing out on up to $40,000 in grant funding?

Content-Type

multipart/alternative; boundary="===============0674708008438599096=="

Received

from PH0PR04MB7819.namprd04.prod.outlook.com (2603:10b6:510:ed::12) by SJ0PR04MB7296.namprd04.prod.outlook.com with HTTPS; Fri, 23 Oct 2026 18:36:41 +0000

from PH7P222CA0022.NAMP222.PROD.OUTLOOK.COM (2603:10b6:510:33a::27) by PH0PR04MB7819.namprd04.prod.outlook.com (2603:10b6:510:ed::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.19; Fri, 23 Oct 2026 18:36:38 +0000

from CY8PEPF00000058.namprd21.prod.outlook.com (2603:10b6:510:33a:cafe::80) by PH7P222CA0022.outlook.office365.com (2603:10b6:510:33a::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.19 via Frontend Transport; Fri, 23 Oct 2026 18:36:38 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by CY8PEPF00000058.mail.protection.outlook.com (10.167.247.21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.0 via Frontend Transport; Fri, 23 Oct 2026 18:36:37 +0000

from pps.filterd (m0280861.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69NIaOSj2539744 for <[email protected]>; Fri, 23 Oct 2026 18:36:37 GMT

from o2.sg.highspot.com (o2.sg.highspot.com [168.245.46.9]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hg8ut0vpe-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Fri, 23 Oct 2026 18:36:36 +0000 (GMT)

by recvd-774b755d6c-6d82c with SMTP id recvd-774b755d6c-6d82c-1-6ADBA933-2E 2026-10-23 18:36:35.415357097 +0000 UTC m=+2079331.760045147

from workflow-67f9494cb4-fz8rp (unknown) by geopod-ismtpd-22 (SG) with ESMTP id zovF9z7eQtCKtChk018LUw for <[email protected]>; Fri, 23 Oct 2026 18:36:35.384 +0000 (UTC)

Received-Spf

Fail (protection.outlook.com: domain of highspot.pltw.org does not designate 148.163.137.252 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.137.252; helo=mx0b-00332601.pphosted.com;

Message-Id

<1936283718.191.1792780563755@workflow-67f9494cb4-fz8rp>

Extracted URLs

  • file http://pltw.org

  • file http://www.linkedin.com/in/danielleryan729

  • file https://calendly.com/dryanpltw/45

  • file https://pltw.file.force.com/file-asset-public/thumbnail_OutlookPLTW_brand?oid=00Do0000000J6Oj

  • file https://pltw.zoom.us/j/91862125153?pwd=aeQAWv2U2bKNae05UtASiTVPTokzkJ.1&amp;from=addon

  • file https://pltw.zoom.us/j/91862125153?pwd=aeQAWv2U2bKNae05UtASiTVPTokzkJ.1&from=addon

  • file https://u15898252.ct.sendgrid.net/wf/open?upn=u001.ioP86mQm8S45iNNjpI9NCEQyfidN8YglWHYd6rxu58043Bx1Azzz42b0b6-2BXEBV4NhczY5x02-2BN19SDteOU2PWYCPRJ-2B9b93UCSFv-2FNKLlJpYqxoXrYTVh5CufqGuGJ82qdg1ZQn3i2Fj7iyb8BUhiy-2B8VVPAKAcISnE0Rm8pdJYMqSs75OwpCcjMv1lNSh-2BSB1zEc0HCgJQsHmJTSFCoh4UKMLT6O8FuUOhWvtCwXFU3Jc3x-2Bi8UxRhov-2FjBLUs2CCecjBt4ZL9NJZa0mpJOV1UrceKoS7EanSgZZWeVVO6iUvRsIOBElXU83987hfNgYYvIJKoB0Q1hEhGadC7nA-3D-3D

  • file https://view-su2.highspot.com/viewer/5a5b148ab6b319a7444a7c4d3bc01761?source=email.6adba9102d8affd1abdedffb.336

  • file https://www.pltw.org/email-unsubscribe