Overview

overview

4

Static

static

1

Message.eml

windows10-2004-x64

4

Message.eml

windows11-ltsc_2024-x64

1

attachment-3.eml

windows10-2004-x64

1

attachment-3.eml

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

image.png

windows10-2004-x64

1

image.png

windows11-ltsc_2024-x64

1

email-html-2.html

windows10-2004-x64

3

email-html-2.html

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

image.png

windows10-2004-x64

1

image.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Message.eml
  • Size 1.2MB
  • Sample261113-xts8tszz6j
  • SHA256 af001559c51373b3310708f2a4d152829335a825fcb218b40fd477665b0beb69
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Message.eml
    .eml 1.2MB
  • attachment-3
    .eml 609KB
  • email-html-2.txt
    .html 104KB
  • email-plain-1.txt
    19KB
  • image.png
    .png 53KB
  • email-html-2.txt
    .html 139KB
  • email-plain-1.txt
    18KB
  • image.png
    .png 53KB

Message.eml

  • SHA256 af001559c51373b3310708f2a4d152829335a825fcb218b40fd477665b0beb69
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 13 Nov 2026 18:24:22 +0000

Subject

Request for Proposal (RFP) for Environmental Services / Supplies

Content-Type

multipart/mixed; boundary="_041_IA0PR17MB6640218F33BDD48FFEE4CB7CA17F2IA0PR17MB6640namp_"

Received

from PH7P220CA0146.NAMP220.PROD.OUTLOOK.COM (2603:10b6:510:327::32) by LV3PR13MB6334.namprd13.prod.outlook.com (2603:10b6:408:19e::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.13; Fri, 13 Nov 2026 18:34:40 +0000

from CY7PEPF000000ED.namprd04.prod.outlook.com (2603:10b6:510:327:cafe::19) by PH7P220CA0146.outlook.office365.com (2603:10b6:510:327::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.9 via Frontend Transport; Fri, 13 Nov 2026 18:34:40 +0000

from BYAPR05CU005.outbound.protection.outlook.com (52.101.85.89) by CY7PEPF000000ED.mail.protection.outlook.com (10.167.247.169) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.4 via Frontend Transport; Fri, 13 Nov 2026 18:34:39 +0000

from IA0PR17MB6640.namprd17.prod.outlook.com (2603:10b6:208:3dc::7) by CC6PR17MB787217.namprd17.prod.outlook.com (2603:10b6:170:202::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.615.10; Fri, 13 Nov 2026 18:24:46 +0000

from IA0PR17MB6640.namprd17.prod.outlook.com ([fe80::4afa:ae64:822a:9e95]) by IA0PR17MB6640.namprd17.prod.outlook.com ([fe80::4afa:ae64:822a:9e95%3]) with mapi id 15.21.0592.010; Fri, 13 Nov 2026 18:24:46 +0000

Received-Spf

Pass (protection.outlook.com: domain of westwardenv.com designates 52.101.85.89 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.85.89; helo=BYAPR05CU005.outbound.protection.outlook.com; pr=C

Message-Id

<IA0PR17MB6640218F33BDD48FFEE4CB7CA17F2@IA0PR17MB6640.namprd17.prod.outlook.com>

Extracted URLs

  • file http://www.westwardenv.com/

  • file https://twitter.com/westwardenv

  • file https://www.facebook.com/westwardenv

  • file https://www.linkedin.com/company/westward-environmental