QuotaExceeded File Synchronization Paused[.]msg

General

Target
QuotaExceeded File Synchronization Paused.msg
Size 94KB
Sample261027-gxe8dayx2m
SHA256 adecd6afeb1691d276414c178d9c3fcb2082b8369383026081c3bb42d7d9038b
MD5 a56cfbd4eb61cd7945af602a18941f84
SHA1 78d5bb2d2701ed9c20258163be0e92bc4f5e5424
SHA512 b8c30b43ce09af208e23582e143232fc9151d4aa566ec4c724c2e49d3a365243c82efe173b2a342fcdb4261f2d591bc556d447494850767b3835ecab3f39aee4
SSDEEP 1536:vFuNL7h9hs9OZFoYFcFoEzXzslBrmVg+0wCEtJ4QR7bW5Qvm:9EF9ywZkFoezWBKVWlEtJHy6m
TLSH
T1729376152AFA222AF273EF354DE5549795367C52AC35C91F2086330F05B2A42ED62B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

QuotaExceeded File Synchronization Paused.msg

.msg 94KB

QuotaExceeded File Synchronization Paused.msg

SHA256 adecd6afeb1691d276414c178d9c3fcb2082b8369383026081c3bb42d7d9038b
MD5 a56cfbd4eb61cd7945af602a18941f84
SHA1 78d5bb2d2701ed9c20258163be0e92bc4f5e5424
SHA512 b8c30b43ce09af208e23582e143232fc9151d4aa566ec4c724c2e49d3a365243c82efe173b2a342fcdb4261f2d591bc556d447494850767b3835ecab3f39aee4
SSDEEP 1536:vFuNL7h9hs9OZFoYFcFoEzXzslBrmVg+0wCEtJ4QR7bW5Qvm:9EF9ywZkFoezWBKVWlEtJHy6m
TLSH
T1729376152AFA222AF273EF354DE5549795367C52AC35C91F2086330F05B2A42ED62B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Date

Mon, 26 Oct 2026 19:46:51 +0000

Subject

QuotaExceeded: File Synchronization Paused

Content-Type

multipart/alternative; boundary="_000_73435b49444a4a4da78237bf291a3d2bSG2PEPF000B66CEapcprd03_"

Received

from DU7PPF0094BB5EB.eurprd01.prod.exchangelabs.com (2603:10a6:18:3::c85) by AM9PR01MB7475.eurprd01.prod.exchangelabs.com with HTTPS; Mon, 26 Oct 2026 20:29:48 +0000

from PA7P264CA0441.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:37d::21) by DU7PPF0094BB5EB.eurprd01.prod.exchangelabs.com (2603:10a6:18:3::c85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.21; Mon, 26 Oct 2026 20:26:58 +0000

from MAD0EPF000008BD.eurprd04.prod.outlook.com (2603:10a6:102:37d:cafe::10) by PA7P264CA0441.outlook.office365.com (2603:10a6:102:37d::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 20:26:58 +0000

from TYPPR03CU001.outbound.protection.outlook.com (2a01:111:f403:dc05::2) by MAD0EPF000008BD.mail.protection.outlook.com (2603:10b6:140::1a4) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 20:26:57 +0000

from SI1PR02CA0006.apcprd02.prod.outlook.com (2603:1096:4:1f7::11) by TY8PR04MB9724.apcprd04.prod.outlook.com (2603:1096:405:3ab::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 19:50:15 +0000

from SG2PEPF000B66CE.apcprd03.prod.outlook.com (2603:1096:4:1f7:cafe::6f) by SI1PR02CA0006.outlook.office365.com (2603:1096:4:1f7::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 19:50:15 +0000

from wesleyan.folio.io.vn (5.181.3.204) by SG2PEPF000B66CE.mail.protection.outlook.com (10.167.240.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 19:50:14 +0000

Received-Spf

Fail (protection.outlook.com: domain of messaging.microsoft.com does not designate 5.181.3.204 as permitted sender) receiver=protection.outlook.com; client-ip=5.181.3.204; helo=wesleyan.folio.io.vn;

Message-Id

<73435b49-444a-4a4d-a782-37bf291a3d2b@SG2PEPF000B66CE.apcprd03.prod.outlook.com>

Extracted URLs

file http://444ik.com
file https://my-files-directory.dongho17.com/

Sharing