Overview

overview

8

Static

static

4

phish_aler...1).eml

windows10-2004-x64

1

phish_aler...1).eml

windows11-ltsc_2024-x64

8

eLearn Cou...26.pdf

windows10-2004-x64

4

eLearn Cou...26.pdf

windows11-ltsc_2024-x64

3

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

4

image001.png

windows10-2004-x64

1

image001.png

windows11-ltsc_2024-x64

1

Resubmissions

02/07/2026, 20:07

260702-yv9gwaax4r4

02/07/2026, 20:04

260702-ytlpesaw9k4

02/07/2026, 20:01

260702-yrpcjady5w8

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (1).eml
  • Size 340KB
  • Sample260702-yrpcjady5w
  • SHA256 8d60632491d30272db36985cc561babd97b1b898e11cd7ec4966a4789a255164
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
pdflink

Malware Config

Signatures

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

    pdf

File Explorer

  • phish_alert_sp2_2.0.0.0 (1).eml
    .eml 340KB
  • eLearn Course Login Procedure-2026.pdf
    .pdf 219KB
  • email-html-1.txt
    .html 18KB
  • image001.png
    .png 7KB

phish_alert_sp2_2.0.0.0 (1).eml

  • SHA256 8d60632491d30272db36985cc561babd97b1b898e11cd7ec4966a4789a255164
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 2 Jun 2026 17:29:37 -0600

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBZb3VyIE51Y2xlYXIgR2F1Z2Ugb25saW5lIGVM?= =?UTF-8?B?ZWFybiB0cmFpbmluZyBjb3Vyc2UgaXMgcmVhZHkgdG8gYmVnaW4=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17830215771670.20135322322734872"

Received

from CH0PR16MB5274.namprd16.prod.outlook.com (2603:10b6:610:18a::11) by IA2PR16MB6450.namprd16.prod.outlook.com with HTTPS; Tue, 2 Jun 2026 23:31:23 +0000

from CYXPR03CA0059.namprd03.prod.outlook.com (2603:10b6:930:d1::11) by CH0PR16MB5274.namprd16.prod.outlook.com (2603:10b6:610:18a::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.17; Tue, 2 Jun 2026 23:29:52 +0000

from CH2PEPF00000147.namprd02.prod.outlook.com (2603:10b6:930:d1:cafe::19) by CYXPR03CA0059.outlook.office365.com (2603:10b6:930:d1::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.7 via Frontend Transport; Tue, 2 Jun 2026 23:29:51 +0000

from mail-dl1-x122f.google.com (2607:f8b0:4864:20::122f) by CH2PEPF00000147.mail.protection.outlook.com (2603:10b6:61f:fc00::368) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Tue, 2 Jun 2026 23:29:51 +0000

by mail-dl1-x122f.google.com with SMTP id a92af1059eb24-137eed84fc6so1567284c88.0 for <[email protected]>; Tue, 02 Jun 2026 16:29:51 -0700 (PDT)

from smtpclient.apple ([205.185.103.78]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-137f554f732sm767462c88.12.2026.06.02.16.29.48 for <[email protected]> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Jun 2026 16:29:48 -0700 (PDT)

X-Received

by 2002:a05:7022:124:b0:137:c122:572d with SMTP id a92af1059eb24-137f6bb4d76mr289177c88.24.1780442989720; Tue, 02 Jun 2026 16:29:49 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of raddisposal.com designates 2607:f8b0:4864:20::122f as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::122f; helo=mail-dl1-x122f.google.com; pr=C

X-Mailer

Apple Mail (2.3826.300.87.4.3)

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification