Potential Phish (30[.]9 KB)[.]msg

Sharing

Copy URL Twitter E-mail

General

Target
Potential Phish (30.9 KB).msg
Size 55KB
Sample261110-wevbxahe45
SHA256 cb9e6995a0aea710946cc377e730fceacc907f4aa14f4d4d50e10856452920f1
MD5 79e36dfe9a1e313cc1bbc8a90a57d041
SHA1 94a78f6f12e849eda6f396a1fd3b1c5fd3078df5
SHA512 fa6f306c39e0d652122962446d4ee2f804ce07779301b5f6f1ca8fe77d648442770bff76d06ad34f6b9e34e2c190ba0c37b030530e47ff8cf2f1419a1726235d
SSDEEP 768:mRfq5za7ZAq8AFJjoIhlel18UFDNhpsALc1Phq6wYayA3yJfXoMfGb2S96rln0P+:TQ7B82dfzeHg1JON0o0GH6xn
TLSH
T19E43FD292AFA0225F2B7DF3549F550939A3A7D52BD359D0E10C1330E09B2A41E9A1F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Potential Phish (30.9 KB).msg

.msg 55KB

Potential Phish (30.9 KB).msg

SHA256 cb9e6995a0aea710946cc377e730fceacc907f4aa14f4d4d50e10856452920f1
MD5 79e36dfe9a1e313cc1bbc8a90a57d041
SHA1 94a78f6f12e849eda6f396a1fd3b1c5fd3078df5
SHA512 fa6f306c39e0d652122962446d4ee2f804ce07779301b5f6f1ca8fe77d648442770bff76d06ad34f6b9e34e2c190ba0c37b030530e47ff8cf2f1419a1726235d
SSDEEP 768:mRfq5za7ZAq8AFJjoIhlel18UFDNhpsALc1Phq6wYayA3yJfXoMfGb2S96rln0P+:TQ7B82dfzeHg1JON0o0GH6xn
TLSH
T19E43FD292AFA0225F2B7DF3549F550939A3A7D52BD359D0E10C1330E09B2A41E9A1F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

[email protected]

Return-Path

[email protected]

Date

10 Nov 2026 16:00:05 +0000

Subject

Response requested from Southern Living

Content-Type

multipart/alternative; boundary="===============4775116681427011570=="

Received

from MW4PR04MB7427.namprd04.prod.outlook.com (2603:10b6:303:7c::18) by IA0SPRMB0032.namprd04.prod.outlook.com with HTTPS; Tue, 10 Nov 2026 16:00:12 +0000

from PH7P220CA0071.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:32c::33) by MW4PR04MB7427.namprd04.prod.outlook.com (2603:10b6:303:7c::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.615.8; Tue, 10 Nov 2026 16:00:09 +0000

from CY7PEPF000000EA.namprd04.prod.outlook.com (2603:10b6:510:32c:cafe::9b) by PH7P220CA0071.outlook.office365.com (2603:10b6:510:32c::33) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.8 via Frontend Transport; Tue, 10 Nov 2026 16:00:08 +0000

from mx0b-00332601.pphosted.com (148.163.137.252) by CY7PEPF000000EA.mail.protection.outlook.com (10.167.247.166) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.4 via Frontend Transport; Tue, 10 Nov 2026 16:00:07 +0000

from pps.filterd (m0266390.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6AAExr9W3019631 for <[email protected]>; Tue, 10 Nov 2026 16:00:06 GMT

from p1-024067.orders.buysub.com (p1-024067.orders.buysub.com [173.213.24.67]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hunn7adct-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 10 Nov 2026 16:00:06 +0000 (GMT)

from NY5PMER177 (10.24.58.139) by p1-024067.orders.buysub.com id hucvos2o8is4 for <[email protected]>; Tue, 10 Nov 2026 11:00:14 -0500 (envelope-from <[email protected]>)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning orders.buysub.com discourages use of 148.163.137.252 as permitted sender)

X-Mailer

XyzMailer

Message-Id

<[email protected]>

Extracted URLs

file http://Outlook.com
file http://l.orders.buysub.com/rts/go2.aspx?h=416764&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/go2.aspx?h=416764&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/go2.aspx?h=416765&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/go2.aspx?h=416765&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/go2.aspx?h=416766&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c&x=2267728885&hp2=b5bd3fcd5dde463bf520c83a53c456c786ad6a6ec087783ecfd6eae5f91640ea
file http://l.orders.buysub.com/rts/go2.aspx?h=416766&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c&x=2267728885&hp2=b5bd3fcd5dde463bf520c83a53c456c786ad6a6ec087783ecfd6eae5f91640ea
file http://l.orders.buysub.com/rts/go2.aspx?h=416767&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c&x=2226&hp2=5502f1b675cb45ac77ceb2ca7a465d584311deea6688ca6aafbf849a8c4660d4
file http://l.orders.buysub.com/rts/go2.aspx?h=416767&tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c&x=2226&hp2=5502f1b675cb45ac77ceb2ca7a465d584311deea6688ca6aafbf849a8c4660d4
file http://l.orders.buysub.com/rts/open.aspx?tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/open.aspx?tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr&pi=u_27SIuEjLqDQZvrloDx-otqj5YrvZQCyRn3goEjD_c
file http://l.orders.buysub.com/rts/un.aspx?tp=i-1NGB-Bg-iWC-6pJtm-1o-6lEaf-1c-6pJcA-lDzpUFFhBz-1fb0wr
file https://cdn.magazines.com/crt/store/covers/magazines/mdp/SLV_l.jpg
file https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap');
file https://w1.buysub.com/pubs/MR/PPL/images/1px_spacer.png
file https://w1.buysub.com/pubs/MR/SLV/images/SLV_Logo_w181.png
file https://w1.buysub.com/servlet/OPOpenRate?cds_fn=415007SLV2226H
Show all