Overview

overview

4

Static

static

1

phish_aler...1).eml

windows10-2004-x64

1

phish_aler...1).eml

windows11-21h2-x64

1

email-html-1.html

windows10-2004-x64

4

email-html-1.html

windows11-21h2-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (1).eml
  • Size 26KB
  • Sample260601-vsn7dabs51
  • SHA256 18b0a5ce6704039789159771bf88da0c873e6433716fc0a33e0f0d2d92e359ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (1).eml
    .eml 26KB
  • email-html-1.txt
    .html 16KB

phish_alert_sp2_2.0.0.0 (1).eml

  • SHA256 18b0a5ce6704039789159771bf88da0c873e6433716fc0a33e0f0d2d92e359ff
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Sender

Joanna Johnson via Docusign <[email protected]>

Return-Path

[email protected]

Date

Fri, 29 May 2026 14:12:14 -0700

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBDb21wbGV0ZWQ6IENlcnQgJiBUcmFucy5wZGY=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17803326898670.7426633453374951"

Received

from SJ0PR16MB4271.namprd16.prod.outlook.com (2603:10b6:a03:329::16) by PH0PR16MB5206.namprd16.prod.outlook.com with HTTPS; Fri, 29 May 2026 21:12:18 +0000

from SA1PR04CA0014.namprd04.prod.outlook.com (2603:10b6:806:2ce::20) by SJ0PR16MB4271.namprd16.prod.outlook.com (2603:10b6:a03:329::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.15; Fri, 29 May 2026 21:12:15 +0000

from SN1PEPF00036F3C.namprd05.prod.outlook.com (2603:10b6:806:2ce:cafe::8e) by SA1PR04CA0014.outlook.office365.com (2603:10b6:806:2ce::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.13 via Frontend Transport; Fri, 29 May 2026 21:12:15 +0000

from mailch.docusign.net (64.207.219.73) by SN1PEPF00036F3C.mail.protection.outlook.com (10.167.248.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Fri, 29 May 2026 21:12:15 +0000

from cuese2fe20p01.corp.docusign.net (da-c103-f51-81.corp.docusign.net [10.103.81.137]) by mailch.docusign.net (Postfix) with ESMTP id 965031013E37 for <[email protected]>; Fri, 29 May 2026 21:12:14 +0000 (UTC)

from cuese2fe20p01 ([127.0.0.1]) by cuese2fe20p01.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697); Fri, 29 May 2026 14:12:14 -0700

Received-Spf

Pass (protection.outlook.com: domain of docusign.net designates 64.207.219.73 as permitted sender) receiver=protection.outlook.com; client-ip=64.207.219.73; helo=mailch.docusign.net; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://na3.docusign.net/Signing/EmailStart.aspx?a=067e3e51-1585-8539-83ce-372ae9f149e0&etti=43&r=09f9d18a-b211-80a2-836c-2e79459ce814

  • file https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi10b7Jsi2l2OG_vZ5LQoI8D5Qfgbv1A1qOfPZOcXAGz0_4K6W4ECYm3YMGkq7fiDh3Bg7wyjL-K-tty7RBAcO7CmLco47RjVL-9pO-Tdyc87nvEqb1fz_IyKmE3J8b9342uxMUlpih6TDJMqRglmMVQdpHmIBB-8230P30EQX0LjuirxRNqeqzFmR-vYkEKIymDluzaCrVKfWh_jHLuEHCds2aLjBDtLpPskPdjOUOdP2CsxayL-RpRxBBTm6NbnKRjLeoe1vzOx6ZVf1HcIknc6pRFsQoWgxrpfFUZ1E_gB_C2DzG73PsREp5etVnLUebTg3eidkyKD8oLk9hgxVL9vA6RV6zBVHVxjedxfxnTzkvhra-hylRLpQ3hEWlD2-G295fOwO8q8rakqM3rZGHiPHreY-yFBuNTyHqeBc5g4EOidA0yCYNlk8XkFuNw5PME&lang=en

  • file https://support.docusign.com/

  • file https://support.docusign.com/s/contactSupport?language=en_US

  • file https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend

  • file https://www.docusign.com/legal/terms-and-conditions

  • file https://www.docusign.com/privacy