General

  • Target
    phish_alert_sp2_2.0.0.0-214.eml
  • Size 130KB
  • Sample260604-s886daas2w
  • SHA256 4c407a47594796beb0f88ae7f854ef60d26ade3ccd8bc6d5f08b331475b4e062
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0-214.eml
    .eml 130KB
  • email-html-2.txt
    .html 6KB
  • email-plain-1.txt
    1KB

phish_alert_sp2_2.0.0.0-214.eml

  • SHA256 4c407a47594796beb0f88ae7f854ef60d26ade3ccd8bc6d5f08b331475b4e062
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Thu, 4 Jun 2026 08:18:21 +0200

Subject

Learning Tech from MasterStart requests you to sign Operations Management Learner Support Document

Content-Type

multipart/related; boundary="----=_NextPart_000_0000_01DCF407.4D4F8E00"

Received

from CPT0EPF0000071E.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:d0:cafe::21) by JN3P275CA0127.outlook.office365.com (2603:1086:0:d0::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.7 via Frontend Transport; Thu, 4 Jun 2026 06:20:38 +0000

from JN3P275CA0127.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:d0::11) by JNZP275MB2944.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:d5::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.7; Thu, 4 Jun 2026 06:20:38 +0000

from za-smtp-inbound-delivery-1.mimecast.co.za (41.74.197.102) by CPT0EPF0000071E.mail.protection.outlook.com (10.167.241.23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Thu, 4 Jun 2026 06:20:37 +0000

by mx.zohomail.com with SMTPS id 1780553901767890.0462011300677; Wed, 3 Jun 2026 23:18:21 -0700 (PDT)

from system-60.transmail.net (system-60.transmail.net [135.84.80.60]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id za-mta-132-6cGy9HW-PYyidcSJIqlzXw-1; Thu, 04 Jun 2026 08:20:33 +0200

from JNZP275MB2944.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:d5::7) by JN1P275MB1176.ZAFP275.PROD.OUTLOOK.COM with HTTPS; Thu, 4 Jun 2026 06:20:53 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning notifications.zohosign.com discourages use of 41.74.197.102 as permitted sender)

X-Mailer

Microsoft Outlook 16.0

Message-Id

<2d6f.267cbd9e.m1.2f8a25f0-5fdd-11f1-afb5-525400a229b1.19e914865cf@notifications.zohosign.com>

Extracted URLs

  • file https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f495623d9359d631825e135e137ce3485e852fb0213c7b1c234722dcab771ca85064e28c98d6c1e9a30512c7ef269c765c9e6d2efdb7f8b55dbc6db8629597f22a41bd97e070e602db1d0e45b02d0801b6e5608c7971655844808a24f78eba23a305914&action_type=SIGN

  • file https://sign.zoho.com/zsguestreminder?locale=en&sign_id=234b4d535f495623d9359d631825e135e137ce3485e852fb0213c7b1c234722dcab771ca85064e28c98d6c1e9a30512c7ef269c765c9e6d2efdb7f8b55dbc6db8629597f22a41bd97e070e602db1d0e45b02d0801b6e5608c7971655844808a24f78eba23a305914

  • file https://www.zoho.com/report-abuse/