Overview

overview

1

Static

static

1

phish_aler...3).eml

windows10-2004-x64

1

phish_aler...3).eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0(3).eml
  • Size 7KB
  • Sample260729-2datrshj5x
  • SHA256 f3d05980e3c03a1a6eb4fb1819dc5e67ddf725adaf532dfd3c5d31db19d70e14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0(3).eml
    .eml 7KB
  • email-html-1.txt
    .html 1KB

phish_alert_sp2_2.0.0.0(3).eml

  • SHA256 f3d05980e3c03a1a6eb4fb1819dc5e67ddf725adaf532dfd3c5d31db19d70e14
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 29 Jul 2026 21:00:11 +0000

Subject

=?UTF-8?B?UzRQIFlvdSBIYXZlIEludm9pY2VzIFdhaXRpbmcgZm9yIEFwcHJv?= =?UTF-8?B?dmFs?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17853613525280.22823405489087922"

Received

from CO6PR16MB4020.namprd16.prod.outlook.com (2603:10b6:303:a4::22) by SA0PR16MB3757.namprd16.prod.outlook.com with HTTPS; Wed, 29 Jul 2026 21:10:08 +0000

from BL1PR13CA0094.namprd13.prod.outlook.com (2603:10b6:208:2b9::9) by CO6PR16MB4020.namprd16.prod.outlook.com (2603:10b6:303:a4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.13; Wed, 29 Jul 2026 21:10:06 +0000

from MN1PEPF0000F0E0.namprd04.prod.outlook.com (2603:10b6:208:2b9:cafe::68) by BL1PR13CA0094.outlook.office365.com (2603:10b6:208:2b9::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.7 via Frontend Transport; Wed, 29 Jul 2026 21:10:04 +0000

from aw2smtp01.hilcorp.com (44.232.200.44) by MN1PEPF0000F0E0.mail.protection.outlook.com (10.167.242.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Wed, 29 Jul 2026 21:10:04 +0000

from HILCORP.COM (unknown [10.31.0.132]) by aw2smtp01.hilcorp.com (Postfix) with ESMTP id 4722718000BE for <[email protected]>; Wed, 29 Jul 2026 21:10:03 +0000 (UTC)

Received-Spf

PermError (protection.outlook.com: domain of hilcorp.com used an invalid SPF mechanism)

X-Mailer

SAP NetWeaver 757

Message-Id

<[email protected]>

Extracted URLs

  • file https://flpnwc-chkcf1nrk6.dispatcher.us4.hana.ondemand.com/sites/fs2ap#ap-MyApprovals?MyApprovals=X&hideHeader=X