original (22)[.]eml

original (22).eml

SHA256 db649fe97e97824dbb32f8d9b0ba4d257c19a32c9b63e8a5bbd894d2d91aaaed
MD5 2252f874e5be84a2d55a11476cae5002
SHA1 a15cb64b8c791df2bf3c7cc6cc7a0cb11b83927e
SHA512 bd2fafed9b11b347fa818c684b0feb856c3a89821c21f61396522a86e327083c50ff8d059474475d25031c2b4f46e8c3eb36eb791b75230fc17d4b5833976ce4
SSDEEP 3072:TvtwxL+GSw66TRRqNaM9lQy0tJN64C8j+X+vXCKNZSjAW52hcPHz:TvSxCm66TRg39UdCMqGSjAS20
TLSH
T15724C05349822364DEECAA18B47E33173AA9358F0DF1208D571EEF9D6130DEE1D924E9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

Email Headers

To

From

Return-Path

Date

Wed, 16 Sep 2026 14:02:37 +0000

Subject

[Phish Alert] Arkayli Biopharma- Request for Quotation (RFQ)

Content-Type

multipart/mixed; boundary="_005_SA1PR09MB97160C4960F6EE9A8B6DC7E4E7B92SA1PR09MB9716namp_"

Received

from BN8PR09CU001.outbound.protection.outlook.com (mail-eastus2azon11012042.outbound.protection.outlook.com [52.101.58.42]) by inbound-smtp.us-east-1.amazonaws.com with SMTP id s7p8l0tvuecfn3ohef7cm0t5mlachrd177fkqso1 for [email protected]; Wed, 16 Sep 2026 14:03:24 +0000 (UTC)

from CYXPR09CA0017.namprd09.prod.outlook.com (2603:10b6:930:d4::28) by SA1PR09MB11305.namprd09.prod.outlook.com (2603:10b6:806:36f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.9; Wed, 16 Sep 2026 14:03:19 +0000

from BN7PEPF0000009A.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::71) by CYXPR09CA0017.outlook.office365.com (2603:10b6:930:d4::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Wed, 16 Sep 2026 14:03:18 +0000

from smtp.us1.defend.egress.com (44.216.154.56) by BN7PEPF0000009A.mail.protection.outlook.com (10.167.243.198) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 14:03:16 +0000

from BL0PR0901CU002.outbound.protection.outlook.com (ip-10-244-236-70.ec2.internal [10.244.236.70]) by smtp1.us1.defend.egress.com (Haraka) with ESMTPS id DF618DD4-439C-46DA-856C-1793E5D2EA41.1 envelope-from <[email protected]> tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256; Wed, 16 Sep 2026 14:03:02 +0000

from SA1PR09MB9716.namprd09.prod.outlook.com (2603:10b6:806:282::22) by SA1PR09MB11179.namprd09.prod.outlook.com (2603:10b6:806:36a::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.11; Wed, 16 Sep 2026 14:02:37 +0000

from SA1PR09MB9716.namprd09.prod.outlook.com ([fe80::689f:6b00:65e3:e35e]) by SA1PR09MB9716.namprd09.prod.outlook.com ([fe80::689f:6b00:65e3:e35e%2]) with mapi id 15.21.0406.007; Wed, 16 Sep 2026 14:02:37 +0000

Received-Spf

pass (spfCheck: domain of cnbglobal.com designates 52.101.58.42 as permitted sender) client-ip=52.101.58.42; [email protected]; helo=BN8PR09CU001.outbound.protection.outlook.com;

TempError (protection.outlook.com: error in processing during lookup of cnbglobal.com: DNS Timeout)

Message-Id

<SA1PR09MB97160C4960F6EE9A8B6DC7E4E7B92@SA1PR09MB9716.namprd09.prod.outlook.com>

Extracted URLs

file https://summary.us1.defend.egress.com/v3/summary?ref=email&crId=6aaaa14bba01ce22cdeb8538&token=NmFhYWExNGJiYTAxY2UyMmNkZWI4NTM4fGRlcnJpY2suc3RhbmxleUBjbmJnbG9iYWwuY29tfDE3OTMwMjMzMDg.mFc2daQAUScg9z4QMFuEavrN2nC-xABYI77Ep3Ui95o&lang=en

KB4UserComments.json

SHA256 12f57593c4e63b1325971e8f1443117e9af81f66b3a2748abf105a47c6e28d56
MD5 08d64bbbccae52e51a89318c0fb7eb0d
SHA1 696fe143c36c56717bccbeaf055d2dd5856fdf82
SHA512 d71bf6c9d5ae324582a629fcc5fd4f8f5c6f394bd69b3ef07bd356c94b567fbd0d54c8e0d14f951cf71eb52f3cb4bedcf2c7b6c83183e0a5140d51f5e1a0394e
MD5 SHA1 SHA512

email-html-2.txt

SHA256 aed239cb2c658130d78fe848fc62615570ff081efa416eaedda5b9dc6b32155b
MD5 d09fe515e587b162b1e2602372a76711
SHA1 9fbbda742687f637e8ae108326e4655191a680ce
SHA512 438791aa0986ef454919428342f3f8a5198a5f8068839e30b6ce6978a9ac426c85f20378761557f6e2d86f2b7a83aa46ac7d326d0fd15cae9c484fa456ef7522
SSDEEP 768:+2PC45dJqMCCMoDB2Fchn1FlTrv24EaqyRK2nWngM1W/fF23XfEwNV+v:NBMoD2ch1FlTr21aqJ37yfQ3P4
TLSH
T11923C000C3A21D11A15E1F04F2EE2F5598572B8BD396DEEA2F2F1679D0CA66D13A370D
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 f66f5f96a6c4b34d1c80523075744b1654df4b2fe014f93c19068b23516afca9
MD5 8124a971b11f6208904bc24b5028d860
SHA1 536d7972e976574b7c84c5e0c88d47f303e9808f
SHA512 33d3065e32c11ff3d0d2b56578f66fe397bcba7472b3444bb18b7994af3618dd7cf43ae6cc9c24e4b567a79c2ea1aa5923ba0b0c22ff36e4a8ac3dc86dbf5d52
TLSH
T19D613053D689A6CC49A4B231740B1FDE996362A4EA1DE44612BFCE683E6EDC3137301C
MD5 SHA1 SHA512 TLSH

phish_alert_sp2_2.0.0.0.eml

SHA256 c8628ee5bff4dccc1b99553cd87632a55354c5327ba4f6b025acd19c040877a2
MD5 0a8f1df1ffd05e4e4985de47ddbc9ef9
SHA1 d8c806984d5c3ca4efd56c3f187060e85c0336ca
SHA512 4db454a1fca0abd91163c907ce6957587268553d8d883b18cf06ab193cd1081eb536614e82a8031bfe05a52dd7200055719fd79e9c8fca938db70c8dda1674df
SSDEEP 1536:rB0LWa21XJJ/B9ndQ85IKZzxtzHoJMUWiJnOFqTVP:d1FJ/B1z7UMUWInOgTl
TLSH
T1A6A35A16E3C0359A80AFC380B86277B8563A5D69A7A26DFD641B3B7C970DCC31756B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

Email Headers

To

From

Reply-To

Return-Path

Date

Wed, 16 Sep 2026 07:01:24 -0700

Subject

=?UTF-8?B?QXJrYXlsaSBCaW9waGFybWEtIFJlcXVlc3QgZm9yIFF1b3RhdGlv?= =?UTF-8?B?biAoUkZRKQ==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17895673570330.6131207118558429"

Received

from SJ0PR09MB10585.namprd09.prod.outlook.com (2603:10b6:a03:516::5) by SA1PR09MB9716.namprd09.prod.outlook.com with HTTPS; Wed, 16 Sep 2026 14:02:07 +0000

from CY5PR09CA0010.namprd09.prod.outlook.com (2603:10b6:930:1::22) by SJ0PR09MB10585.namprd09.prod.outlook.com (2603:10b6:a03:516::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.12; Wed, 16 Sep 2026 14:02:01 +0000

from BN5PEPF00047594.namprd09.prod.outlook.com (2603:10b6:930:1:cafe::68) by CY5PR09CA0010.outlook.office365.com (2603:10b6:930:1::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Wed, 16 Sep 2026 14:02:01 +0000

from smtp.us1.defend.egress.com (18.246.145.202) by BN5PEPF00047594.mail.protection.outlook.com (10.167.248.87) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 14:02:00 +0000

from BL0PR0901CU002.outbound.protection.outlook.com (ip-10-243-209-43.us-west-2.compute.internal [10.243.209.43]) by smtp1.us1.defend.egress.com (Haraka) with ESMTPS id 99303A33-EA94-4CCC-AD80-E62AFF6257CC.1 envelope-from <[email protected]> tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256; Wed, 16 Sep 2026 14:01:29 +0000

from CY5PR09CA0008.namprd09.prod.outlook.com (2603:10b6:930:1::16) by DS9PR09MB12127.namprd09.prod.outlook.com (2603:10b6:8:2c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.11; Wed, 16 Sep 2026 14:01:27 +0000

from BN7PEPF00000099.namprd09.prod.outlook.com (2603:10b6:930:1:cafe::f) by CY5PR09CA0008.outlook.office365.com (2603:10b6:930:1::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.11 via Frontend Transport; Wed, 16 Sep 2026 14:01:26 +0000

from smtp75.iad3b.emailsrvr.com (146.20.161.75) by BN7PEPF00000099.mail.protection.outlook.com (10.167.243.197) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7 via Frontend Transport; Wed, 16 Sep 2026 14:01:25 +0000

by smtp2.relay.iad3b.emailsrvr.com (Authenticated sender: ann-AT-brilliant-graphics.com) with ESMTPSA id 4E97D20394 for <[email protected]>; Wed, 16 Sep 2026 10:01:25 -0400 (EDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning brilliant-graphics.com discourages use of 18.246.145.202 as permitted sender)

Pass (protection.outlook.com: domain of brilliant-graphics.com designates 146.20.161.75 as permitted sender) receiver=protection.outlook.com; client-ip=146.20.161.75; helo=smtp75.iad3b.emailsrvr.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

file https://summary.us1.defend.egress.com/v3/summary?ref=email&crId=6aaaa14bba01ce22cdeb8538&token=NmFhYWExNGJiYTAxY2UyMmNkZWI4NTM4fGRlcnJpY2suc3RhbmxleUBjbmJnbG9iYWwuY29tfDE3OTMwMjMzMDg.mFc2daQAUScg9z4QMFuEavrN2nC-xABYI77Ep3Ui95o&lang=en

email-html-1.txt

SHA256 77c0e48b5968aba83f3ee58f8099d7456f176c19e5c7c7378153d44c88785906
MD5 4933343d5090f7e9e30728815cc32807
SHA1 1340a3c950ab92b6df71b3a7e2a277c47ec7e166
SHA512 bde841cbfedb4ac55fb0c9f38a23c25b96ca4e55741a3077227eb7aecc759ae66488a7f4a5db9b74cb220aebfb77f858dfa5ff84abd264f9ab9d59b281c8aefc
SSDEEP 768:XJqvWaOIAnaWzLT6YU0MoDB2Fchn1FlTrv24EaqyRK2nWngM1W/fF23XfEwNVuf:XXMoD2ch1FlTr21aqJ37yfQ3Pm
TLSH
T130734A12E3D0352980AFC240F9A2B7BC563D9556A7A15EFE695A3B7DE30DCC3132291C
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

original (22).eml

Email Headers

Extracted URLs

KB4UserComments.json

email-html-2.txt

email-plain-1.txt

phish_alert_sp2_2.0.0.0.eml

Email Headers

Extracted URLs

email-html-1.txt