Overview

overview

4

Static

static

1

phish_aler....0.eml

windows10-2004-x64

4

phish_aler....0.eml

windows11-ltsc_2024-x64

1

Screenshot...06.png

windows10-2004-x64

1

Screenshot...06.png

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 108KB
  • Sample260723-txw74ssfne
  • SHA256 c54b8148c939d81a0c6a91dfb91e6f71c10517fe19188a56529151fc86398420
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 108KB
  • Screenshot 2025-10-13 202906.png
    .png 49KB
  • email-html-1.txt
    .html 18KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 c54b8148c939d81a0c6a91dfb91e6f71c10517fe19188a56529151fc86398420
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 23 Jul 2026 16:16:32 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBXb3J0aCBsb29raW5nIGF0PyAtwqBIaWxjb3Jw?= =?UTF-8?B?IEVuZXJneQ==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17848238421910.04340492361305448"

Received

from IA1PR16MB5422.namprd16.prod.outlook.com (2603:10b6:208:452::16) by BN0PR16MB4479.namprd16.prod.outlook.com with HTTPS; Thu, 23 Jul 2026 16:20:15 +0000

from DSSP220CA0007.NAMP220.PROD.OUTLOOK.COM (2603:10b6:8:3d3::10) by IA1PR16MB5422.namprd16.prod.outlook.com (2603:10b6:208:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Thu, 23 Jul 2026 16:16:48 +0000

from DS3PEPF0000C37A.namprd04.prod.outlook.com (2603:10b6:8:3d3:cafe::6c) by DSSP220CA0007.outlook.office365.com (2603:10b6:8:3d3::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.11 via Frontend Transport; Thu, 23 Jul 2026 16:16:47 +0000

from CY7PR03CU001.outbound.protection.outlook.com (2a01:111:f403:c112::5) by DS3PEPF0000C37A.mail.protection.outlook.com (2603:10b6:f:fc00::204) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Thu, 23 Jul 2026 16:16:47 +0000

from BN9PR03CA0650.namprd03.prod.outlook.com (2603:10b6:408:13b::25) by BN8PR14MB3281.namprd14.prod.outlook.com (2603:10b6:408:d7::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Thu, 23 Jul 2026 16:16:41 +0000

from BN2PEPF000044AC.namprd04.prod.outlook.com (2603:10b6:408:13b:cafe::30) by BN9PR03CA0650.outlook.office365.com (2603:10b6:408:13b::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.11 via Frontend Transport; Thu, 23 Jul 2026 16:16:41 +0000

from us-dlp.cloud-sec-av.com (3.214.204.181) by BN2PEPF000044AC.mail.protection.outlook.com (10.167.243.107) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Thu, 23 Jul 2026 16:16:41 +0000

from emails-8145571-56-mt-prod-3.avanan.net (ip-10-10-157-17.ec2.internal [10.10.157.17]) by mta-outgoing-dlp-781-mt-prod-3.avanan.net (Postfix) with ESMTPS id 793D480FED for <[email protected]>; Thu, 23 Jul 2026 16:16:41 +0000 (UTC)

from DM6PR14MB2618.namprd14.prod.outlook.com (2603:10b6:5:11d::18) by CH4PR14MB7601.namprd14.prod.outlook.com (2603:10b6:610:231::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Thu, 23 Jul 2026 16:16:32 +0000

from DM6PR14MB2618.namprd14.prod.outlook.com ([fe80::7ccc:263f:35ec:cca1]) by DM6PR14MB2618.namprd14.prod.outlook.com ([fe80::7ccc:263f:35ec:cca1%3]) with mapi id 15.21.0245.009; Thu, 23 Jul 2026 16:16:32 +0000

Received-Spf

Pass (protection.outlook.com: domain of texasfa.com designates 2a01:111:f403:c112::5 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c112::5; helo=CY7PR03CU001.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of texasfa.com designates 3.214.204.181 as permitted sender) receiver=protection.outlook.com; client-ip=3.214.204.181; helo=us-dlp.cloud-sec-av.com; pr=C

Message-Id

<DM6PR14MB261899EB9708A76EAEB6EAC98EC02@DM6PR14MB2618.namprd14.prod.outlook.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://cL6t604.na1.hs-sales-engage.com/Ctc/RH+23284/cL6t604/Jks2-6qcW69sMD-6lZ3l2W40Jfg23-hqz5W8Xh3YD15TZfJW6rGS-d6CsMVkVjtBVn32FRqLW6xv-Qq31NqvVW4Dqjry20b27zN5S6w162DpQfVfS2nv1DK83YW1Yrm3L6GHJ2dW6DmWlm42MStzW8wJhg_90bYQHW726c6466J4G5W1424zg2rD9F2W8D9cLk6Z8RQCW3QcQyv73kYpSW99gr_q4kmLSXN1pgf8DGyybwW8lGnyD2ggNtFW1jwKdD1HrtHDW8Vcq0V5WVJhPf82ypJK04

  • file https://cL6t604.na1.hs-sales-engage.com/Ctc/RH+23284/cL6t604/Jl22-6qcW7lCdLW6lZ3ndVqmRSR5GpYdZW8mWmHh2z8f_nM-RFFnNq15xN87Yl-01WGVNW6s35KM2T4s6WW4gThZm15kVTKW10tL8g7Gj7sGW56lyY96s0S_zN3nPtN8ZmnlHW4GBJGh18K-jGW6plpgd95Xvc8W361y-p6DyQZyW1Z-WSJ6YhQhNW5xxHBj1f8s7PN5YjwMqXhzF7W2bgpr25r0QlGW5kS9rG4V4RrRW10M7CM1kqznyW6_qkt85DCTrHW8wDVs-1FsCJwW8-GVtG4GGBrDW6nHNyC48TbHTMkXrqkpZcfXW2c1DqF6-SDTyf5s6FHW04

  • file https://cL6t604.na1.hs-sales-engage.com/Ctc/RH+23284/cL6t604/Jl22-6qcW7lCdLW6lZ3pFW2hzFKH3H-Mj5W1l2Mqg6b1M5RW6St42t3s6WFbW21LGCy310L08W5bNl1r2xqWg8W8jQZ5R3mHGn8W94ZJ_d9jvxCVN6GKNCsYHQgTW1rcmXN777QTXW4C8B266YBsR3W91HbmH3dlsLMW73BcyV2F7l4tW2vCkrr2Mj8hqW4SzgrX2Sw29zW51hTSc5b-xBkV6DTvl6jXYp7W71r8jZ8_bxC9W44RFPd670jR0W5KKvX94PdtJHW6hhcHN8TZRSsVnLM7b3Zy7sxW2Rr6kw3dCwFMW3mdGcj83cN7NW1ClKP843C0xXf7rN13l04

  • file https://cL6t604.na1.hs-sales-engage.com/Ctc/RH+23284/cL6t604/Jl22-6qcW7lCdLW6lZ3q3W8M1hgP1K2lmQW6rpQ1Z75-Z2SW2HpgWL3BtJFCN2KtqZ2c9QDFW3sXn697c9R_PW3zfNn12Kt30QW2G4YCb4kn7VXW4SXlzS6gRmMCW7bH_DM685zDpW8wHcmJ2vWJqpN4JxkfvcvBLFW2YHxgp6GKnpNW84X_1Q4_-KXPW6jtXyD5yK3CGW6lGvqB7vKw31W2yWfJC23QmGJW7-9BGB6XyHfNW4JP82T9fyM0YM3DCV0y1y3KW8LCvTL1tXMk6W1Vlr4d11mrhnW94Zb7Y2F_QnVVDRHFW5vJMLxW7rhfHb66jnN-f3V3rST04

  • file https://hubs.ly/Q04qxz7x0

  • file https://www.texasfa.com/