Potential Phish (42[.]3 KB)[.]msg

Sharing

Copy URL Twitter E-mail

General

Target
Potential Phish (42.3 KB).msg
Size 57KB
Sample261026-sls6msbd35
SHA256 607aee2ed1a7907a4037859bdbb36d409e7f2243ac5b3a9fe450b2110802b65d
MD5 606b1b0cf993a292449419f341c8f2c9
SHA1 a79c192fabca1d6f19c1b8031af8e83cd8189a13
SHA512 4969045771d4e1aa4611eec7b28dccf41f7cdb29910ed7ae9e82a7cb32931606adcce2be95858bb7c3605adedf675c6b375d109b8f9ce304091843367ca4614c
SSDEEP 768:L6f/Xkr99S7pHlihM5gS7jTePKDNhT/bxqSNhC1w2Pw98/hhPOw7d8xdfWsG5Dai:C/XooFihWX72SNhmw2I8vN7wtGE
TLSH
T1A94341283AFA0216F1B7DF359EE25453993B7E526E35D95E10C1334A05B2A40EC62F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Potential Phish (42.3 KB).msg

.msg 57KB

Potential Phish (42.3 KB).msg

SHA256 607aee2ed1a7907a4037859bdbb36d409e7f2243ac5b3a9fe450b2110802b65d
MD5 606b1b0cf993a292449419f341c8f2c9
SHA1 a79c192fabca1d6f19c1b8031af8e83cd8189a13
SHA512 4969045771d4e1aa4611eec7b28dccf41f7cdb29910ed7ae9e82a7cb32931606adcce2be95858bb7c3605adedf675c6b375d109b8f9ce304091843367ca4614c
SSDEEP 768:L6f/Xkr99S7pHlihM5gS7jTePKDNhT/bxqSNhC1w2Pw98/hhPOw7d8xdfWsG5Dai:C/XooFihWX72SNhmw2I8vN7wtGE
TLSH
T1A94341283AFA0216F1B7DF359EE25453993B7E526E35D95E10C1334A05B2A40EC62F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

subscription-canceled+[email protected]

Reply-To

[email protected]

Return-Path

010101a16a68e7df-b3db62cf-1bc1-47ad-b724-4d585c0492d3-000000@bounce.stripe.com

Date

Fri, 23 Oct 2026 20:17:02 +0000

Subject

=?utf-8?q?Magic_School=2C_Inc=2E_subscription_cancellation_confirma?= =?utf-8?q?tion_-_we=E2=80=99re_sorry_to_see_you_go=2E?=

Content-Type

multipart/alternative; boundary="===============1004190689777917060=="

Received

from DM6PR04MB6842.namprd04.prod.outlook.com (2603:10b6:5:243::10) by BN7PR04MB5314.namprd04.prod.outlook.com with HTTPS; Fri, 23 Oct 2026 20:17:11 +0000

from CY5PR14CA0013.namprd14.prod.outlook.com (2603:10b6:930:2::23) by DM6PR04MB6842.namprd04.prod.outlook.com (2603:10b6:5:243::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.19; Fri, 23 Oct 2026 20:17:05 +0000

from MWH0EPF000D8953.namprd05.prod.outlook.com (2603:10b6:930:2:cafe::11) by CY5PR14CA0013.outlook.office365.com (2603:10b6:930:2::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.19 via Frontend Transport; Fri, 23 Oct 2026 20:17:05 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by MWH0EPF000D8953.mail.protection.outlook.com (10.167.249.219) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Fri, 23 Oct 2026 20:17:04 +0000

from pps.filterd (m0266390.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69NIaD5P357618 for <[email protected]>; Fri, 23 Oct 2026 20:17:03 GMT

from a85-219.smtp-out.us-west-2.amazonses.com (a85-219.smtp-out.us-west-2.amazonses.com [54.240.85.219]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hg7u9hd92-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Fri, 23 Oct 2026 20:17:03 +0000 (GMT)

Received-Spf

Fail (protection.outlook.com: domain of bounce.stripe.com does not designate 148.163.137.252 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.137.252; helo=mx0b-00332601.pphosted.com;

Message-Id

<010101a16a68e7df-b3db62cf-1bc1-47ad-b724-4d585c0492d3-000000@us-west-2.amazonses.com>

Extracted URLs

file http://a.st
file http://div.st
file http://div.st-Icon.st
file http://div.st-Spacer.st
file http://div.st-Target.st
file http://magicschool.ai
file http://span.st
file http://span.st-Delink.st
file http://table.st
file http://table.st-Header.st
file http://table.st-Width.st
file http://td.st
file http://td.st-Font.st
file http://td.st-Header-logo.st
file http://td.st-Spacer.st
file http://tr.st
file https://59.email.stripe.com/CL0/https:/billing.stripe.com/p/session/flow%3Fsecret=live_YWNjdF8xTjhVN2VIYzJnMEZxM1ZQLF9WVW9XWlFwa0xmTmxjOEQ2STRpT3lWc2M3dEVLczly0100NTw0kor2/1/010101a16a68e7df-b3db62cf-1bc1-47ad-b724-4d585c0492d3-000000/joikqtDJKUaIQVRxgQGSQWrAdsUyxyrDqtYBf6a02FI=452
file https://59.email.stripe.com/CL0/https:/stripe.com/1/010101a16a68e7df-b3db62cf-1bc1-47ad-b724-4d585c0492d3-000000/wQi55YMBWXm8MMkvpV0LDA6V7atE5DIas7vNIeLr1to=452
file https://stripe-images.s3.amazonaws.com/emails/acct_1N8U7eHc2g0Fq3VP/1/[email protected]
file https://stripe-images.s3.amazonaws.com/html_emails/2017-08-21/header/Header-background--mobile.png')
file https://stripe-images.s3.amazonaws.com/html_emails/2017-08-21/header/Header-background--white--mobile.png')
file https://stripe-images.s3.amazonaws.com/html_emails/2017-08-21/header/Header-background--white.png')
file https://stripe-images.s3.amazonaws.com/html_emails/2017-08-21/header/Header-background.png')
file https://stripe-images.s3.amazonaws.com/html_emails/2018-05-02/header/Header-logo--atlasAzlo.png')
file https://stripe-images.s3.amazonaws.com/html_emails/2023-03-30/header/stripe_logo_blurple_email_highres.png')
file https://stripe-images.s3.amazonaws.com/notifications/icons/document--16--regular.png')
file https://stripe-images.stripecdn.com/notifications/hosted/20180110/Header/Left.png
file https://stripe-images.stripecdn.com/notifications/hosted/20180110/Header/Right.png
file https://www.magicschool.ai
Show all