Overview

overview

7

Static

static

1

phish_aler...1).eml

windows10-2004-x64

3

phish_aler...1).eml

windows11-21h2-x64

3

C2_signatu...6e.png

windows10-2004-x64

1

C2_signatu...6e.png

windows11-21h2-x64

C2_signatu...29.png

windows10-2004-x64

1

C2_signatu...29.png

windows11-21h2-x64

C2_signatu...e7.png

windows10-2004-x64

1

C2_signatu...e7.png

windows11-21h2-x64

C2_signatu...62.png

windows10-2004-x64

1

C2_signatu...62.png

windows11-21h2-x64

C2_signatu...10.png

windows10-2004-x64

1

C2_signatu...10.png

windows11-21h2-x64

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (1).eml
  • Size 194KB
  • Sample260507-ablppsgs4q
  • SHA256 6d1d9fc1328fc62646a4999edd29c7acaab8df0fb8ea3b3a8d08919fcf2a1bbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (1).eml
    .eml 194KB
  • C2_signature_facebook_de641155-b458-42f0-a6a2-793aff344a6e.png
    .png 15KB
  • C2_signature_instagram_71241da6-b9b2-4bdf-ab79-89222cc36529.png
    .png 46KB
  • C2_signature_linkedin_35fc4abe-7d96-42f3-b57d-783e56c4aae7.png
    .png 23KB
  • C2_signature_swcmgiconlogo_2f69f945-29a8-4957-b32a-14d87a2c3062.png
    .png 6KB
  • C2_signature_youtube_16bd8fcd-d70e-4b85-99b4-d1143ca5bf10.png
    .png 26KB
  • email-html-1.txt
    .html 14KB

phish_alert_sp2_2.0.0.0 (1).eml

  • SHA256 6d1d9fc1328fc62646a4999edd29c7acaab8df0fb8ea3b3a8d08919fcf2a1bbf
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 6 May 2026 16:02:17 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBJUyBGYXVsdCBSaXNrLCBPaGlvIE9wZXJhdGlv?= =?UTF-8?B?bnM=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17780883309440.8296842349635887"

Received

from PH7PR16MB4817.namprd16.prod.outlook.com (2603:10b6:510:13f::11) by DM8PR16MB4536.namprd16.prod.outlook.com with HTTPS; Wed, 6 May 2026 16:03:22 +0000

from PH2PEPF0000384E.namprd17.prod.outlook.com (2603:10b6:518:1::6f) by PH7PR16MB4817.namprd16.prod.outlook.com (2603:10b6:510:13f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9870.25; Wed, 6 May 2026 16:02:26 +0000

from CY4PEPF0000EDD2.namprd03.prod.outlook.com (2a01:111:f403:f912::1) by PH2PEPF0000384E.outlook.office365.com (2603:1036:903:48::3) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9870.27 via Frontend Transport; Wed, 6 May 2026 16:02:25 +0000

from YQZPR01CU011.outbound.protection.outlook.com (2a01:111:f403:c104::) by CY4PEPF0000EDD2.mail.protection.outlook.com (2603:10b6:92f::1003:0:6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.9 via Frontend Transport; Wed, 6 May 2026 16:02:25 +0000

from YT1PR01MB8972.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:cf::17) by YT5PR01MB10897.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:137::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.16; Wed, 6 May 2026 16:02:19 +0000

from YT1PR01MB8972.CANPRD01.PROD.OUTLOOK.COM ([fe80::fc70:a014:897d:ddc7]) by YT1PR01MB8972.CANPRD01.PROD.OUTLOOK.COM ([fe80::fc70:a014:897d:ddc7%4]) with mapi id 15.20.9891.015; Wed, 6 May 2026 16:02:17 +0000

Received-Spf

Pass (protection.outlook.com: domain of seisware.com designates 2a01:111:f403:c104:: as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c104::; helo=YQZPR01CU011.outbound.protection.outlook.com; pr=C

Message-Id

<YT1PR01MB89727C42AA8BAFEDEB46AA16C53F2@YT1PR01MB8972.CANPRD01.PROD.OUTLOOK.COM>

Extracted URLs

  • file http://www.seisware.com/

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://www.facebook.com/SeisWare

  • file https://www.instagram.com/seiswaresoftware/

  • file https://www.youtube.com/@seisware