Overview

overview

5

Static

static

5

ORDEN DE C....A.svg

windows10-2004-x64

3

ORDEN DE C....A.svg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 202KB
  • Sample260825-tdcpcsvfpb
  • SHA256 27c6297e012131041ab62f60512f9380049263a1fb5aa673f283166b68c6016c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
svgjavascript

Malware Config

Signatures

  • Suspicious SVG script tag 1 IoCs
    svgjavascript
  • SVG contains script element(s) 1 IoCs
    svgjavascript

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 202KB
  • ORDEN DE COMPRA Inversiones Rovigo PV C.A.svg
    .svg .js .xml 131KB
  • email-html-1.txt
    .html 9KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 27c6297e012131041ab62f60512f9380049263a1fb5aa673f283166b68c6016c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 24 Aug 2026 19:23:05 +0200

Subject

=?UTF-8?B?T1JERU4gREUgQ09NUFJBIEludmVyc2lvbmVzIFJvdmlnbyBQViBD?= =?UTF-8?B?LkE=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17876722790350.006507054462003281"

Received

from BLAPR16MB3842.namprd16.prod.outlook.com (2603:10b6:208:271::7) by LV2PR16MB7117.namprd16.prod.outlook.com with HTTPS; Mon, 24 Aug 2026 17:51:11 +0000

from BN9PR03CA0337.namprd03.prod.outlook.com (2603:10b6:408:f6::12) by BLAPR16MB3842.namprd16.prod.outlook.com (2603:10b6:208:271::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.14; Mon, 24 Aug 2026 17:50:48 +0000

from BN1PEPF00005FFE.namprd05.prod.outlook.com (2603:10b6:408:f6:cafe::39) by BN9PR03CA0337.outlook.office365.com (2603:10b6:408:f6::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.12 via Frontend Transport; Mon, 24 Aug 2026 17:50:48 +0000

from mail-vk1-f175.google.com (209.85.221.175) by BN1PEPF00005FFE.mail.protection.outlook.com (10.167.243.230) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Mon, 24 Aug 2026 17:50:48 +0000

by mail-vk1-f175.google.com with SMTP id 71dfb90a1353d-5bf959b820cso2964932e0c.3 for <[email protected]>; Mon, 24 Aug 2026 10:50:48 -0700 (PDT)

X-Received

by 2002:a05:690c:11:b0:81e:fe1c:2de8 with SMTP id 00721157ae682-85472640a72mr3696897b3.3.1787592199676; Mon, 24 Aug 2026 10:23:19 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of gmail.com designates 209.85.221.175 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.221.175; helo=mail-vk1-f175.google.com; pr=C

Message-Id

<CAD2-FGzSN0d-neU-dNDLcGMJMWV9EuN4Nm924WYkkYSMqShh=g@mail.gmail.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification