General

  • Target
    phish_alert_sp2_2.0.0.0 (1).eml
  • Size 37KB
  • Sample260527-ynswjsa191
  • SHA256 7a5b1cfb1cbc0a1a92d6b02356c6b98d89e20800c60dc0c0cc52442b5e064a51
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (1).eml
    .eml 37KB
  • 02140f2a-ef83-418d-9d3f-45d2111841a4
    .png 812B
  • 40d002d8-3240-4147-a04a-4332b1fae395
    .png 4KB
  • 9a892bbd-03f3-41eb-832e-d3bf452f817e
    .png 812B
  • e08636e4-b917-4b33-8d68-591e846b95f7
    .png 8KB
  • email-html-1.txt
    .html 10KB

phish_alert_sp2_2.0.0.0 (1).eml

  • SHA256 7a5b1cfb1cbc0a1a92d6b02356c6b98d89e20800c60dc0c0cc52442b5e064a51
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

SharePoint Online <[email protected]>

Return-Path

[email protected]

Date

Wed, 27 May 2026 18:55:20 +0000

Subject

=?UTF-8?B?QWN0aW9uIHJlcXVpcmVkOiBFcmljIENvbGxldHQgYXNrZWQgdG8g?= =?UTF-8?B?ZWRpdCAiSGVscGluZyBIYW5kcyAoMSki?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17799081985350.029205371567620597"

Received

from BN0PR16MB4399.namprd16.prod.outlook.com (2603:10b6:408:152::23) by MW5PR16MB4618.namprd16.prod.outlook.com with HTTPS; Wed, 27 May 2026 18:55:26 +0000

from BY5PR03CA0022.namprd03.prod.outlook.com (2603:10b6:a03:1e0::32) by BN0PR16MB4399.namprd16.prod.outlook.com (2603:10b6:408:152::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.17; Wed, 27 May 2026 18:55:21 +0000

from CO1PEPF00012E7F.namprd03.prod.outlook.com (2603:10b6:a03:1e0:cafe::9d) by BY5PR03CA0022.outlook.office365.com (2603:10b6:a03:1e0::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.19 via Frontend Transport; Wed, 27 May 2026 18:55:21 +0000

from canadaeast0.notifyp.svc.ms (20.200.33.46) by CO1PEPF00012E7F.mail.protection.outlook.com (10.167.249.54) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via Frontend Transport; Wed, 27 May 2026 18:55:20 +0000

Message-Id

<SharingAccessRequest-0054923d-d117-4109-9667-05075c9e195a;rcid_75cf17a2-305d-0000-bd71-872f49be3a8a;wiid_68f877cf-26b5-4295-86f9-21e306983cf8;r0-ioe_1-tid_257ad91e-ce4b-4e01-8232-f79537810d30-rh_cae_notifyp-aid_7115b866-72d6-4858-8643-545abb402762@odspnotify>

Extracted URLs

  • file https://hilcorp0.sharepoint.com/sites/2021Hurricane/Access%20Requests/pendingreq.aspx?mbypass=1&e=PZJUABfRCUGWZwUHXJ4ZWg&at=113

  • file https://hilcorp0.sharepoint.com/sites/2021Hurricane/Shared%20Documents/General/Helping%20Hands/Helping%20Hands%20%281%29.pdf?web=1&e=PZJUABfRCUGWZwUHXJ4ZWg&at=113