Overview

overview

4

Static

static

3

=?Windows-...29.pdf

windows10-2004-x64

4

=?Windows-...29.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 90KB
  • Sample260707-ecp6qset6k
  • SHA256 1ff4ac9b7f759c0cd8e90e1d9a0c4b36c7dca0dfc719d07dcd2ccffd21b3d115
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 90KB
  • =?Windows-1252?Q?You=92ve_received_a_new_File_via_Dropbox_Online_-_Jack_R?= =?Windows-1252?Q?obinson_=281=29.pdf?=
    .pdf 40KB
  • email-html-2.txt
    .html 17KB
  • email-plain-1.txt
    398B

phish_alert_sp2_2.0.0.0.eml

  • SHA256 1ff4ac9b7f759c0cd8e90e1d9a0c4b36c7dca0dfc719d07dcd2ccffd21b3d115
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Thu, 2 Jul 2026 07:30:09 +0930

Subject

Jack Robinson sent you a file using Dropbox

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0000_01DD09F9.3057F3C0"

Received

from MEUPR01CU001.outbound.protection.outlook.com (2a01:111:f403:c40e::1) by SY2PEPF00004FF5.mail.protection.outlook.com (2603:10c6:18::107) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Wed, 1 Jul 2026 22:00:14 +0000

from SY2PEPF00004FF5.ausprd01.prod.outlook.com (2603:10c6:10:205:cafe::88) by SY5P282CA0142.outlook.office365.com (2603:10c6:10:205::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.10 via Frontend Transport; Wed, 1 Jul 2026 22:00:16 +0000

from SY2PPF1D93025A7.AUSP300.PROD.OUTLOOK.COM ([fe80::312d:fc76:564a:fd9e]) by SY2PPF1D93025A7.AUSP300.PROD.OUTLOOK.COM ([fe80::312d:fc76:564a:fd9e%4]) with mapi id 15.21.0181.009; Wed, 1 Jul 2026 22:00:09 +0000

from SY2PPF1D93025A7.AUSP300.PROD.OUTLOOK.COM (2603:10c6:18::389) by ME0P300MB0397.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:22b::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.9; Wed, 1 Jul 2026 22:00:09 +0000

from SY5P282CA0142.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:205::12) by ME4P282MB1367.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:94::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.9; Wed, 1 Jul 2026 22:00:16 +0000

from ME4P282MB1367.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:94::11) by SY0P282MB5986.AUSP282.PROD.OUTLOOK.COM with HTTPS; Wed, 1 Jul 2026 22:01:53 +0000

Received-Spf

Pass (protection.outlook.com: domain of straightupaccess.com.au designates 2a01:111:f403:c40e::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c40e::1; helo=MEUPR01CU001.outbound.protection.outlook.com; pr=C

X-Mailer

Microsoft Outlook 16.0

Message-Id

<SY2PPF1D93025A71D8EA8412B559C1D5BB48BF62@SY2PPF1D93025A7.AUSP300.PROD.OUTLOOK.COM>

Extracted URLs

  • file http://www.straightupaccess.com.au/