Overview

overview

5

Static

static

5

ANSE0301_5...94.pdf

windows10-2004-x64

5

ANSE0301_5...94.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 136KB
  • Sample260730-e8f8psbg94
  • SHA256 db826fb6fad618f7883c4b8fdbc5d7a83a8d65210fbbf1d91c9261b976b8b8e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 136KB
  • ANSE0301_521411994.pdf
    .pdf 82KB
  • email-html-1.txt
    .html 12KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 db826fb6fad618f7883c4b8fdbc5d7a83a8d65210fbbf1d91c9261b976b8b8e7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 30 Jul 2026 03:26:03 +0000 (GMT)

Subject

HLCL Sh# 15758489 Doc# HLCUBKK2606AWYZ2

Content-Type

multipart/mixed; boundary="----=_Part_205338_-1036892143.1785381963390"

Received

from SY7P282MB6035.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:301::10) by SY5P282MB6250.AUSP282.PROD.OUTLOOK.COM with HTTPS; Thu, 30 Jul 2026 03:26:13 +0000

from SY5P282CA0109.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:20b::17) by SY7P282MB6035.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:301::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.14; Thu, 30 Jul 2026 03:26:08 +0000

from SY3PEPF0000A724.ausprd01.prod.outlook.com (2603:10c6:10:20b:cafe::4b) by SY5P282CA0109.outlook.office365.com (2603:10c6:10:20b::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.14 via Frontend Transport; Thu, 30 Jul 2026 03:26:08 +0000

from cluster-b.mailcontrol.com (85.115.56.190) by SY3PEPF0000A724.mail.protection.outlook.com (10.167.241.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 03:26:07 +0000

(from mailcontrol@localhost) by rly19b.srv.mailcontrol.com (MailControl) with ESMTP id 66U3Q58C3688033 for [email protected]; Thu, 30 Jul 2026 03:26:05 GMT

from rly19b.srv.mailcontrol.com (localhost [127.0.0.1]) by localhost (envelope-sender [email protected]) (MIMEDefang) with ESMTP id 66U3Q4rr3687745 (TLS bits=256 verify=NO) for [email protected]; Thu, 30 Jul 2026 03:26:04 +0000 (UTC)

from localhost.localdomain (localhost.localdomain [127.0.0.1]) by rly19b.srv.mailcontrol.com (MailControl) id 66U3Q4KC3687728 for [email protected]; Thu, 30 Jul 2026 03:26:04 GMT

from kfdcrmailhup01.hlcl.com ([194.9.166.104]) by rly19b-eth0.srv.mailcontrol.com (envelope-sender [email protected]) (MIMEDefang) with ESMTP id 66U3Q3ZQ3687702 (TLS bits=256 verify=NO) for [email protected]; Thu, 30 Jul 2026 03:26:04 +0000 (UTC)

from 3swfsy01-1.hlcl.com (3swfsy01-1.hlcl.com [194.29.111.1]) by kfdcrmailhup01.hlcl.com (Postfix) with ESMTP id 624208014C for <[email protected]>; Thu, 30 Jul 2026 05:26:03 +0200 (CEST)

Received-Spf

Pass (protection.outlook.com: domain of HLAG.COM designates 85.115.56.190 as permitted sender) receiver=protection.outlook.com; client-ip=85.115.56.190; helo=cluster-b.mailcontrol.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification