General

  • Target
    -3393924490936622394.eml
  • Size 208KB
  • Sample260803-sekwpabc75
  • SHA256 0efde79927bc4ddda8c53d6f13fbc95e1bf90ced6af43e505bc716d9d0f27566
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

File Explorer

  • -3393924490936622394.eml
    .eml 208KB
  • Phillip Hallenbeck.pdf
    .pdf 144KB
  • email-plain-1.txt
    1KB

-3393924490936622394.eml

  • SHA256 0efde79927bc4ddda8c53d6f13fbc95e1bf90ced6af43e505bc716d9d0f27566
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounce+[email protected]

Date

Mon, 3 Aug 2026 09:05:12 -0500

Subject

Employment Verification - Please see attachment (time sensitive)

Content-Type

multipart/mixed; boundary="------_=_NextPart_001_036CB919.ECF5ECE9"

Received

from CH2PR12MB9520.namprd12.prod.outlook.com (2603:10b6:610:280::15) by MN2PR12MB4126.namprd12.prod.outlook.com with HTTPS; Mon, 3 Aug 2026 14:05:23 +0000

from DSSP220CA0009.NAMP220.PROD.OUTLOOK.COM (2603:10b6:8:3d3::17) by CH2PR12MB9520.namprd12.prod.outlook.com (2603:10b6:610:280::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Mon, 3 Aug 2026 14:05:08 +0000

from DS3PEPF000099DC.namprd04.prod.outlook.com (2603:10b6:8:3d3:cafe::8b) by DSSP220CA0009.outlook.office365.com (2603:10b6:8:3d3::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.18 via Frontend Transport; Mon, 3 Aug 2026 14:05:08 +0000

from k16.kb8c70eb.use4.send.mailgun.net (204.220.184.16) by DS3PEPF000099DC.mail.protection.outlook.com (10.167.17.198) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Mon, 3 Aug 2026 14:05:08 +0000

from verifacts25.verifacts.local (gateway.vfacts.com [70.90.148.141]) by bfce438e73b612a7cb70c8da7cb19b3155830ab9a5974f4ee5f324437d904c95 with SMTP id 6a70a01122800e529f27bd18; Mon, 03 Aug 2026 14:05:05 GMT

Received-Spf

Pass (protection.outlook.com: domain of mg.vfacts.com designates 204.220.184.16 as permitted sender) receiver=protection.outlook.com; client-ip=204.220.184.16; helo=k16.kb8c70eb.use4.send.mailgun.net; pr=C

X-Mailer

AutoMate

Message-Id

<22207cb9069f3c9b8de600085e35343e@verifacts25>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://nam12.safelinks.protection.outlook.com/?url=