Overview

overview

3

Static

static

1

phish_aler....0.eml

windows10-2004-x64

1

phish_aler....0.eml

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 19KB
  • Sample260730-wxpjdavbkh
  • SHA256 6893f770daa77429903d4314d6c5fc54ed7ab77033eb5c895f327bc75751cc6c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 19KB
  • email-html-1.txt
    .html 10KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 6893f770daa77429903d4314d6c5fc54ed7ab77033eb5c895f327bc75751cc6c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

0100019fb427282f-99a3d2c4-a3e6-4d0a-b87c-29653257a667-000000@mail.bissafety.app

Date

Thu, 30 Jul 2026 17:51:32 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBOZXcgY29udGVudCBoYXMgYmVlbiBhZGRlZCB0?= =?UTF-8?B?byB5b3VyIG9ubGluZSBhY2NvdW50?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17854350950760.6002703121501721"

Received

from SA1PR16MB5989.namprd16.prod.outlook.com (2603:10b6:806:3b4::9) by BL0PR16MB2465.namprd16.prod.outlook.com with HTTPS; Thu, 30 Jul 2026 17:51:54 +0000

from CH2PR04CA0014.namprd04.prod.outlook.com (2603:10b6:610:52::24) by SA1PR16MB5989.namprd16.prod.outlook.com (2603:10b6:806:3b4::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.15; Thu, 30 Jul 2026 17:51:33 +0000

from CH2PEPF00000147.namprd02.prod.outlook.com (2603:10b6:610:52:cafe::1f) by CH2PR04CA0014.outlook.office365.com (2603:10b6:610:52::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.14 via Frontend Transport; Thu, 30 Jul 2026 17:51:33 +0000

from a8-71.smtp-out.amazonses.com (54.240.8.71) by CH2PEPF00000147.mail.protection.outlook.com (10.167.244.104) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 17:51:33 +0000

Received-Spf

Pass (protection.outlook.com: domain of mail.bissafety.app designates 54.240.8.71 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.8.71; helo=a8-71.smtp-out.amazonses.com; pr=C

X-Mailer

ColdFusion 2025 Application Server

Message-Id

<0100019fb427282f-99a3d2c4-a3e6-4d0a-b87c-29653257a667-000000@email.amazonses.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://login.alaskasafetyalliance.org/

  • file https://login.alaskasafetyalliance.org/v1/index.cfm?action=learner.Help&company=_84114A553B05A3C6B06ADFBD61FB2307

  • file https://www.bissafety.app/index.cfm?action=home.unsubscribeemail&v=1&data=E559192EECC0D4CBD47E14731AA403CF26E5FEB3E2BB9F454D16E454F6B2609C410F3165FF57B0E6AA29B6128D7A4776BE43F6F1D94E81CA2874D093B2A1D0E5

  • file https://www.bissafety.app/reset-password