General

  • Target
    phish_alert_sp2_2.0.0.0-247.eml
  • Size 213KB
  • Sample260804-sezd3scf43
  • SHA256 21ad8195789a4f01d4ba93fa8e7818edcfd8ec677d3dcd1f5fbbd153be7739f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • phish_alert_sp2_2.0.0.0-247.eml
    .eml 213KB
  • attachment.pdf
    .pdf 133KB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    961B

phish_alert_sp2_2.0.0.0-247.eml

  • SHA256 21ad8195789a4f01d4ba93fa8e7818edcfd8ec677d3dcd1f5fbbd153be7739f4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Tue, 4 Aug 2026 09:54:20 +1000

Subject

ARL Correspondence | Reference DT 107349885-110435056

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0000_01DD23F7.E0DA7390"

Received

from SY1PEPF000066C4.ausprd01.prod.outlook.com (2603:10c6:10:208:cafe::ad) by SY5P282CA0005.outlook.office365.com (2603:10c6:10:208::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.18 via Frontend Transport; Mon, 3 Aug 2026 23:54:21 +0000

from SY5P282CA0005.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:208::9) by MEYP282MB3562.AUSP282.PROD.OUTLOOK.COM (2603:10c6:220:17a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Mon, 3 Aug 2026 23:54:21 +0000

from SY2PR01CU004.outbound.protection.outlook.com (2a01:111:f403:c40d::2) by SY1PEPF000066C3.mail.protection.outlook.com (2603:10c6:18::135) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Mon, 3 Aug 2026 23:54:27 +0000

from carbon.ci.com.au (raucus.ci.com.au [192.168.1.103]) by convex.ci.com.au (8.18.1/8.18.1/CE250121) with ESMTP id 673NsKjp004754 for <[email protected]>; Tue, 4 Aug 2026 09:54:20 +1000 (AEST) (envelope-from bing_failover+[email protected])

from convex-dkim.ci.com.au (convex-dkim.ci.com.au [192.168.1.241]) by convex-dkim.ci.com.au (8.18.1/8.18.1/CE250121) with ESMTP id 673NsKwD004757 for <[email protected]>; Tue, 4 Aug 2026 09:54:20 +1000 (AEST) (envelope-from bing_failover+[email protected])

from convex.ci.com.au (203.1.242.12) by SY1PEPF000066C4.mail.protection.outlook.com (10.167.241.54) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Mon, 3 Aug 2026 23:54:21 +0000

from SY5P282CA0001.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:208::15) by SY0PR01MB10242.ausprd01.prod.outlook.com (2603:10c6:10:300::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Mon, 3 Aug 2026 23:54:28 +0000

from SY0PR01MB10242.ausprd01.prod.outlook.com (2603:10c6:10:300::11) by SY9PR01MB10782.ausprd01.prod.outlook.com with HTTPS; Mon, 3 Aug 2026 23:55:01 +0000

from SY1PEPF000066C3.ausprd01.prod.outlook.com (2603:10c6:10:208:cafe::a2) by SY5P282CA0001.outlook.office365.com (2603:10c6:10:208::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.18 via Frontend Transport; Mon, 3 Aug 2026 23:54:28 +0000

Received-Spf

Pass (protection.outlook.com: domain of bingmail.com.au designates 203.1.242.12 as permitted sender) receiver=protection.outlook.com; client-ip=203.1.242.12; helo=convex.ci.com.au; pr=C

X-Mailer

Microsoft Outlook 16.0

Message-Id

<[email protected]>

Extracted URLs

  • file http://bingmail.com.au/resmap/3JPRFR4Q7Y.jpg

  • file https://aka.ms/LearnAboutSenderIdentification