General

  • Target
    Phishing_0abc86e8-6dd6-423d-45fa-08df0f3dbb98_ezecler@hrselenios.com_(consulta) 09_15_2026 17_27_21.eml
  • Size 54KB
  • Sample260916-jl8fwsgp91
  • SHA256 c2c2d6faaf7218abec460255fda86ee52371e0a4c5abde052a1da57ba490dcc3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Phishing_0abc86e8-6dd6-423d-45fa-08df0f3dbb98_ezecler@hrselenios.com_(consulta) 09_15_2026 17_27_21.eml
    .eml 54KB
  • attachment-2
    .eml 13KB
  • email-plain-1.txt
    771B
  • email-plain-1.txt
    9KB

Phishing_0abc86e8-6dd6-423d-45fa-08df0f3dbb98_ezecler@hrselenios.com_(consulta) 09_15_2026 17_27_21.eml

  • SHA256 c2c2d6faaf7218abec460255fda86ee52371e0a4c5abde052a1da57ba490dcc3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 15 Sep 2026 17:27:21 +0000

Subject

Phishing:0abc86e8-6dd6-423d-45fa-08df0f3dbb98|[email protected]|(consulta) 09/15/2026 17:27:21

Content-Type

multipart/mixed; boundary="_002_JMR0abc86e86dd6423d45fa08df0f3dbb98Phish639250900412770_"

Received

from PAWPR03MB9215.eurprd03.prod.outlook.com (2603:10a6:102:343::18) by DBAPR03MB6661.eurprd03.prod.outlook.com with HTTPS; Tue, 15 Sep 2026 17:27:39 +0000

from PAZP264CA0070.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1fd::13) by PAWPR03MB9215.eurprd03.prod.outlook.com (2603:10a6:102:343::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Tue, 15 Sep 2026 17:27:33 +0000

from MI3PEPF00008484.eurprd02.prod.outlook.com (2603:10a6:102:1fd:cafe::3) by PAZP264CA0070.outlook.office365.com (2603:10a6:102:1fd::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.13 via Frontend Transport; Tue, 15 Sep 2026 17:27:33 +0000

from nat.eu.perception-point.io (99.80.189.20) by MI3PEPF00008484.mail.protection.outlook.com (10.167.240.171) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Tue, 15 Sep 2026 17:27:33 +0000

from DB6PR07CU003.outbound.protection.outlook.com (mail-db6pr07cu00304.outbound.protection.outlook.com [40.93.64.92]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id 597vs7glhtgd1q85nq853rm65b5levl9m5jvfi81 for [email protected]; Tue, 15 Sep 2026 17:27:30 +0000 (UTC)

from AS4P192CA0034.EURP192.PROD.OUTLOOK.COM (2603:10a6:20b:658::13) by DB9PR03MB9736.eurprd03.prod.outlook.com (2603:10a6:10:451::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Tue, 15 Sep 2026 17:27:25 +0000

from DB1PEPF000509F8.eurprd02.prod.outlook.com (2603:10a6:20b:658:cafe::5c) by AS4P192CA0034.outlook.office365.com (2603:10a6:20b:658::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.9 via Frontend Transport; Tue, 15 Sep 2026 17:27:25 +0000

from GVXPR05CU001.outbound.protection.outlook.com (2a01:111:f403:c202::7) by DB1PEPF000509F8.mail.protection.outlook.com (2603:10a6:18:3::69a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Tue, 15 Sep 2026 17:27:25 +0000

from AM0PR03MB230948.eurprd03.prod.outlook.com (2603:10a6:20b:805::5) by GV1PR03MB8688.eurprd03.prod.outlook.com (2603:10a6:150:90::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Tue, 15 Sep 2026 17:27:21 +0000

from AM0PR03MB230948.eurprd03.prod.outlook.com ([fe80::42d1:a4b7:b694:7545]) by AM0PR03MB230948.eurprd03.prod.outlook.com ([fe80::42d1:a4b7:b694:7545%4]) with mapi id 15.21.0428.008; Tue, 15 Sep 2026 17:27:21 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning alsea.net discourages use of 99.80.189.20 as permitted sender)

pass (spfCheck: domain of alsea.net designates 40.93.64.92 as permitted sender) client-ip=40.93.64.92; [email protected]; helo=DB6PR07CU003.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of alsea.net designates 2a01:111:f403:c202::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c202::7; helo=GVXPR05CU001.outbound.protection.outlook.com; pr=C

Message-Id

<JMR.0abc86e8-6dd6-423d-45fa-08df0f3dbb98.Phish.639250900412770279@microsoft.com>

Extracted URLs

  • file https://eur05.safelinks.protection.outlook.com/?url=