Overview

overview

3

Static

static

3

Inv.3988933.pdf

windows10-2004-x64

3

Inv.3988933.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (33).eml
  • Size 343KB
  • Sample260729-jetddsz1bt
  • SHA256 5e375b675506d4347fff599562e0aa578b3f4a3c6e12fabbb88ed3502b174024
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

    pdf

File Explorer

  • phish_alert_sp2_2.0.0.0 (33).eml
    .eml 343KB
  • Inv.3988933.pdf
    .pdf 225KB
  • email-html-1.txt
    .html 12KB
  • image.jpg
    .jpg 4KB

phish_alert_sp2_2.0.0.0 (33).eml

  • SHA256 5e375b675506d4347fff599562e0aa578b3f4a3c6e12fabbb88ed3502b174024
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

CAOf3zgO1=Yy64LRgZKf0gqDD8ZKfxpe5xTFNbqrDS0G7Q31ZOw@mail.gmail.com

Return-Path

[email protected]

Date

Tue, 28 Jul 2026 11:16:15 +0200

Subject

=?UTF-8?B?TWFja2F5IC0gU3VibWlzc2lvbiBvZiBvdXRzdGFuZGluZyBpbnZv?= =?UTF-8?B?aWNlcw==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17853040734890.8612235611438114"

Received

from GV1PR04MB10477.eurprd04.prod.outlook.com (::1) by VI1PR04MB5006.eurprd04.prod.outlook.com with HTTPS; Wed, 29 Jul 2026 04:58:58 +0000

from AS4P195CA0047.EURP195.PROD.OUTLOOK.COM (2603:10a6:20b:65a::24) by GV1PR04MB10477.eurprd04.prod.outlook.com (2603:10a6:150:1cb::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 04:56:02 +0000

from AMS1EPF00000040.eurprd04.prod.outlook.com (2603:10a6:20b:65a:cafe::5b) by AS4P195CA0047.outlook.office365.com (2603:10a6:20b:65a::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Wed, 29 Jul 2026 04:56:02 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (195.130.217.221) by AMS1EPF00000040.mail.protection.outlook.com (10.167.16.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Wed, 29 Jul 2026 04:56:02 +0000

from mail-ua1-f51.google.com (mail-ua1-f51.google.com [209.85.222.51]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-100-PUuhCQJEPlibwzri5zXktQ-1; Tue, 28 Jul 2026 10:16:29 +0100

by mail-ua1-f51.google.com with SMTP id a1e0cc1a2514c-97754fa4d85so15844241.0 for <[email protected]>; Tue, 28 Jul 2026 02:16:29 -0700 (PDT)

X-Received

by 2002:a05:6102:5248:b0:739:b6bf:bc9e with SMTP id ada2fe7eead31-754a21b06f3mr333773137.3.1785230187676; Tue, 28 Jul 2026 02:16:27 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of mackyacomm.com designates 209.85.222.51 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.222.51; helo=mail-ua1-f51.google.com; pr=C

Message-Id

<CAOf3zgO0Tc8y_GV4Y9TogRLuTTuRoXkz2aaWVrZjY2uR9gWOyg@mail.gmail.com>

Extracted URLs

  • file https://report.mimecastcybergraph.com?action=safe&magiclink=https%3A%2F%2Fapi.services.mimecast.com%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26client_id%3Do20nRkVXf7VUVnANkXhoOwGytEwGN0YAlyeDJn7oBTGNl2kN%26state%3DeyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.YcbOo3pL631ebsF_ICpCPbyCU6CdIaav-Abfd6Ohg3K3-uOC7bqUmslTF3cVI0vWSRueoVpyKdsjWyfgLV5jcjCUyplIe7P9-jqt7NStpZzyGQC-tClor8lJ63Y12Mc1rU-SqaNGwoL0PK9v87Efd-ZoYFAcSn711Th4GR_WRyx7l62HlDanjX2GlruKCAqVzYvVgUMIp6KdJ8ynDC2Qr9EytKKPPl1cGKd45dok4UgR-HG2qcIlRCzESpgAKgMooeCNTJsEU-cMk-VreA7Y_RQ6s7cgkstYuD4aaMtwQBfuD989M7MFdu9PL64hkdFUajxxo5L9V_gaWgo0YQkY9Q.hYpokWPo8bEV4uN9.lO8mmHcWfgTc2Idk8RpgM_cTKWnh33LLe0DdDae1VS5k1efSlCMgUCzf5WCkl_lFL4GAg18tDJCIreIhr-29iMs7cFGu1QcmeyxYg-Yv5J-mu2GSVAuAxB5Cm3RwYBQVDo5sCXChSiRH0PJSgIPqLL4Mg-jzwYif2g3BDLru8yMYaqhJKlZSnpV4Z5iTgcBLrNVJvsnEAczPu1x8s-GliDE7QL3k67E57ktGEo_RBrlAzFiqcXuwn0fD4soXt8zQD-tthYnIssp7nt_N2HeNdKO_UjlS-pdgBzTSHfFNS1H7pratiN64hIO0qJlY6IgJEgiPhhVopO8MFQ1q-kTF9jouIzS_phhjedHNwt-fH1KOJt2878SAW-yg61sD3H9tuay0_HpXYpsDSc1NAGTc4yHKx7n2CxFXqDIMaYx7z8qr_ANOTyav8AYvUo4XFpDTivhKEVd621pFPp7DTBbuE--VTlZdMrH6uNDcRk6gY7OUQV1-SpiLD3NlbDZZvBd2UAFESoYEmaVWvvMdGDpPoj7ePn7OJ-IA1ilEgd3OYGJPI9c4TV4w6gGSaJMQ0kRqOpwTG8QiAiZl6NpNDt8xVQA3dse0SxWuEnhPS3vVd4bGL1vBwxqyXsHvzmnfGICWx1ZcKZnpm143sU1iH9_I0-YwHf48CZ11-urZvrzVZFGHg28N9hVDW_fKAYJrUp4FJDmEa0MRt7FXyG0zjwpw75XAPTvGkRCw1igNd3S3o3muCh3oappMcVX2x1aszsoBOm-SDlOl3Tz0kR3YD2IrnxeEj0VHxRELImgQefqILOyzcyb9SpsXWhIHIAv8oFm_EW0OYOYmxceBAfaHvF0.TvCg9jDCR3jKaVvpOXG9eg%26redirect_uri%3Dhttps%3A%2F%2Freport.mimecastcybergraph.com%2Fcallback

  • file https://report.mimecastcybergraph.com?magiclink=https%3A%2F%2Fapi.services.mimecast.com%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26client_id%3Do20nRkVXf7VUVnANkXhoOwGytEwGN0YAlyeDJn7oBTGNl2kN%26state%3DeyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.YcbOo3pL631ebsF_ICpCPbyCU6CdIaav-Abfd6Ohg3K3-uOC7bqUmslTF3cVI0vWSRueoVpyKdsjWyfgLV5jcjCUyplIe7P9-jqt7NStpZzyGQC-tClor8lJ63Y12Mc1rU-SqaNGwoL0PK9v87Efd-ZoYFAcSn711Th4GR_WRyx7l62HlDanjX2GlruKCAqVzYvVgUMIp6KdJ8ynDC2Qr9EytKKPPl1cGKd45dok4UgR-HG2qcIlRCzESpgAKgMooeCNTJsEU-cMk-VreA7Y_RQ6s7cgkstYuD4aaMtwQBfuD989M7MFdu9PL64hkdFUajxxo5L9V_gaWgo0YQkY9Q.hYpokWPo8bEV4uN9.lO8mmHcWfgTc2Idk8RpgM_cTKWnh33LLe0DdDae1VS5k1efSlCMgUCzf5WCkl_lFL4GAg18tDJCIreIhr-29iMs7cFGu1QcmeyxYg-Yv5J-mu2GSVAuAxB5Cm3RwYBQVDo5sCXChSiRH0PJSgIPqLL4Mg-jzwYif2g3BDLru8yMYaqhJKlZSnpV4Z5iTgcBLrNVJvsnEAczPu1x8s-GliDE7QL3k67E57ktGEo_RBrlAzFiqcXuwn0fD4soXt8zQD-tthYnIssp7nt_N2HeNdKO_UjlS-pdgBzTSHfFNS1H7pratiN64hIO0qJlY6IgJEgiPhhVopO8MFQ1q-kTF9jouIzS_phhjedHNwt-fH1KOJt2878SAW-yg61sD3H9tuay0_HpXYpsDSc1NAGTc4yHKx7n2CxFXqDIMaYx7z8qr_ANOTyav8AYvUo4XFpDTivhKEVd621pFPp7DTBbuE--VTlZdMrH6uNDcRk6gY7OUQV1-SpiLD3NlbDZZvBd2UAFESoYEmaVWvvMdGDpPoj7ePn7OJ-IA1ilEgd3OYGJPI9c4TV4w6gGSaJMQ0kRqOpwTG8QiAiZl6NpNDt8xVQA3dse0SxWuEnhPS3vVd4bGL1vBwxqyXsHvzmnfGICWx1ZcKZnpm143sU1iH9_I0-YwHf48CZ11-urZvrzVZFGHg28N9hVDW_fKAYJrUp4FJDmEa0MRt7FXyG0zjwpw75XAPTvGkRCw1igNd3S3o3muCh3oappMcVX2x1aszsoBOm-SDlOl3Tz0kR3YD2IrnxeEj0VHxRELImgQefqILOyzcyb9SpsXWhIHIAv8oFm_EW0OYOYmxceBAfaHvF0.TvCg9jDCR3jKaVvpOXG9eg%26redirect_uri%3Dhttps%3A%2F%2Freport.mimecastcybergraph.com%2Fcallback

  • file https://url.uk.m.mimecastprotect.com/s/1zR0CZWDlI5mlZGLtzfNfBJaHx?domain=mackaycomm.com/