Overview

overview

3

Static

static

1

Heath_Bell...ge.pdf

windows10-2004-x64

3

Heath_Bell...ge.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 - 2026-08-04T112056.198.eml
  • Size 243KB
  • Sample260804-twftqssvdz
  • SHA256 19e678b9946d5b1b70157b9cf73974316fd91830d16ec6c4b4e99594d2b549c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 - 2026-08-04T112056.198.eml
    .eml 243KB
  • Heath_Bell_Case_Evaluation_Package.pdf
    .pdf 155KB
  • email-html-1.txt
    .html 10KB

phish_alert_sp2_2.0.0.0 - 2026-08-04T112056.198.eml

  • SHA256 19e678b9946d5b1b70157b9cf73974316fd91830d16ec6c4b4e99594d2b549c8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 3 Aug 2026 18:15:17 -0400

Subject

=?UTF-8?B?UmVxdWVzdCBmb3IgQ2FzZSBFdmFsdWF0aW9uIOKAlCBIZWF0aCBC?= =?UTF-8?B?ZWxsIChUZW5uZXNzZWUgdi4gQmVsbCwgTm8uIDEzLTAxMjg2KQ==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17858603484260.4126604891852962"

Received

from SJ0PR09MB7214.namprd09.prod.outlook.com (2603:10b6:a03:258::23) by BY5PR09MB6001.namprd09.prod.outlook.com with HTTPS; Tue, 4 Aug 2026 00:00:56 +0000

from BL0PR0901CA0014.namprd09.prod.outlook.com (2603:10b6:208:1c0::24) by SJ0PR09MB7214.namprd09.prod.outlook.com (2603:10b6:a03:258::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Tue, 4 Aug 2026 00:00:32 +0000

from SA2PEPF00002252.namprd09.prod.outlook.com (2603:10b6:208:1c0:cafe::7) by BL0PR0901CA0014.outlook.office365.com (2603:10b6:208:1c0::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.17 via Frontend Transport; Tue, 4 Aug 2026 00:00:31 +0000

from mail.fd.org (206.16.244.100) by SA2PEPF00002252.mail.protection.outlook.com (10.167.242.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Tue, 4 Aug 2026 00:00:31 +0000

from EMAILMX06.fd.org (172.23.42.6) by EMAILMX06.fd.org (172.23.42.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Tue, 4 Aug 2026 00:00:06 +0000

from mx03.fd.org (172.23.13.14) by EMAILMX06.fd.org (172.23.42.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Tue, 4 Aug 2026 00:00:06 +0000

from unknown (HELO mail-qv2-f0.google.com) ([74.125.230.128]) by mx03.fd.org with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 04 Aug 2026 00:00:01 +0000

by mail-qv2-f0.google.com with SMTP id 6a1803df08f44-8ef118ead8eso23215246d6.0 for <[email protected]>; Mon, 03 Aug 2026 17:00:01 -0700 (PDT)

from 452416976462 named unknown by gmailapi.google.com with HTTPREST; Mon, 3 Aug 2026 18:15:17 -0400

from 452416976462 named unknown by gmailapi.google.com with HTTPREST; Mon, 3 Aug 2026 18:15:17 -0400

X-Received

by 2002:a05:6820:f0b:b0:6ae:7e3d:b9c8 with SMTP id 006d021491bc7-6ae7e3dba23mr3981719eaf.9.1785795319499; Mon, 03 Aug 2026 15:15:19 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of gmail.com designates 74.125.230.128 as permitted sender) receiver=protection.outlook.com; client-ip=74.125.230.128; helo=unknown; pr=C

Message-Id

<CABZhsLJKBHoo6e2fXupYXA6UFzc9kqhBHKoPBssxq-YRy5-w9w@mail.gmail.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification