Overview

overview

4

Static

static

1

Message.eml

windows10-2004-x64

4

Message.eml

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

every-texan-logo.png

windows10-2004-x64

1

every-texan-logo.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 44KB
  • Sample261030-tnypksdv21
  • SHA256 78867331cc60c8fe0d9da4045b6e6648cfa8460105f0a8dd079f04b82fd9a32c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 44KB
  • email-html-2.txt
    .html 5KB
  • email-plain-1.txt
    1KB
  • every-texan-logo.png
    .png 14KB

Message.eml

  • SHA256 78867331cc60c8fe0d9da4045b6e6648cfa8460105f0a8dd079f04b82fd9a32c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 30 Oct 2026 15:28:35 +0000

Subject

State employee pay and working conditions survey

Content-Type

multipart/related; boundary="_004_DM6PR18MB365105E7769180915CE95BFFAA6D2DM6PR18MB3651namp_"; type="multipart/alternative"

Received

from DS1PR02CA0028.namprd02.prod.outlook.com (2603:10b6:8:44a::9) by DS7PR13MB7499.namprd13.prod.outlook.com (2603:10b6:8:264::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.10; Fri, 30 Oct 2026 15:28:45 +0000

from CY8PEPF00000058.namprd21.prod.outlook.com (2603:10b6:8:44a:cafe::1b) by DS1PR02CA0028.outlook.office365.com (2603:10b6:8:44a::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.17 via Frontend Transport; Fri, 30 Oct 2026 15:28:45 +0000

from BL0PR03CU003.outbound.protection.outlook.com (52.101.53.139) by CY8PEPF00000058.mail.protection.outlook.com (10.167.247.21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.0 via Frontend Transport; Fri, 30 Oct 2026 15:28:44 +0000

from DM6PR18MB3651.namprd18.prod.outlook.com (2603:10b6:5:2a5::14) by BY1PR18MB5303.namprd18.prod.outlook.com (2603:10b6:a03:534::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.10; Fri, 30 Oct 2026 15:28:35 +0000

from DM6PR18MB3651.namprd18.prod.outlook.com ([fe80::26f9:5c5d:8f3e:3493]) by DM6PR18MB3651.namprd18.prod.outlook.com ([fe80::26f9:5c5d:8f3e:3493%4]) with mapi id 15.21.0569.009; Fri, 30 Oct 2026 15:28:35 +0000

Received-Spf

Pass (protection.outlook.com: domain of everytexan.org designates 52.101.53.139 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.53.139; helo=BL0PR03CU003.outbound.protection.outlook.com; pr=C

Message-Id

<DM6PR18MB365105E7769180915CE95BFFAA6D2@DM6PR18MB3651.namprd18.prod.outlook.com>

Extracted URLs

  • file https://everytexan.org

  • file https://everytexan.org/

  • file https://s.alchemer.com/s3/texasstateemployees

  • file https://s.alchemer.com/s3/texasstateemployees?agency=TCEQ&wave=1