General

  • Target
    Sascha.eml
  • Size 107KB
  • Sample260622-levbssbs7t
  • SHA256 954d26ead35948d0c3ce447a3c3d5840e82a43606ac686bdf5815421c533aabe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

File Explorer

  • Sascha.eml
    .eml 107KB
  • Sascha_Compliance_Review_ffd7d605-3ad4-494a-b1c9-42d76daeae6d.pdf
    .pdf 58KB
  • email-html-1.txt
    .html 11KB

Sascha.eml

  • SHA256 954d26ead35948d0c3ce447a3c3d5840e82a43606ac686bdf5815421c533aabe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
*+^GGa7ow#w98R8V

Email Headers

From

Calderapacific-Notification.MessageID-ffd7d605-3ad4-494a-b1c9-42d76daeae6d@netvigator.com

Return-Path

Calderapacific-Notification.MessageID-ffd7d605-3ad4-494a-b1c9-42d76daeae6d@netvigator.com

Date

Mon, 22 Jun 2026 09:07:00 -0000

Subject

=?utf-8?b?UO+4gGXvuINuZO+4gGlu77iBZyBE77iCb2N177iDbWVudO+4gSBmb3Ig?= =?utf-8?b?c++4gWFzY2jvuIJhQGNhbO+4g2Rlcu+4g2FwYWPvuIJpZu+4gWlj77iBLmPvuINv?= =?utf-8?b?bSAtIFJlZu+4gWVy77iAZe+4gW5j77iDZTogU++4gGHvuINz77iAY++4gmjvuIBh?= =?utf-8?b?77iALWfvuIJiTnFsdWZWSW9wT0poVO+4gw==?=

Content-Type

multipart/mixed; boundary="===============3694576746853658882=="

Received

from PS2PR01CA0067.apcprd01.prod.exchangelabs.com (2603:1096:300:57::31) by SEZPR04MB7650.apcprd04.prod.outlook.com (2603:1096:101:1ee::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.19; Mon, 22 Jun 2026 09:07:07 +0000

from TY2PEPF0000AB84.apcprd03.prod.outlook.com (2603:1096:300:57:cafe::4c) by PS2PR01CA0067.outlook.office365.com (2603:1096:300:57::31) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.19 via Frontend Transport; Mon, 22 Jun 2026 09:07:07 +0000

from wironout2a.netvigator.com (219.76.94.30) by TY2PEPF0000AB84.mail.protection.outlook.com (10.167.253.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.10 via Frontend Transport; Mon, 22 Jun 2026 09:07:06 +0000

from unknown (HELO yironoah01.netvigator.com) ([203.198.23.151]) by wironout2.netvigator.com with ESMTP; 22 Jun 2026 17:07:06 +0800

from unn-156-146-45-101.cdn77.com (HELO netvigator.com) ([156.146.45.101]) by yironoah01.netvigator.com with ESMTP; 22 Jun 2026 17:07:03 +0800

Received-Spf

Pass (protection.outlook.com: domain of netvigator.com designates 219.76.94.30 as permitted sender) receiver=protection.outlook.com; client-ip=219.76.94.30; helo=wironout2a.netvigator.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification