Overview

overview

3

Static

static

1

phish_aler....0.eml

windows10-2004-x64

1

phish_aler....0.eml

windows11-ltsc_2024-x64

1

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 39KB
  • Sample260916-xdtvescf56
  • SHA256 e7ee374b92335b63fed9498f14944e9dc1b32496567e13a0add300b9407781d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 39KB
  • email-html-1.txt
    .html 29KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 e7ee374b92335b63fed9498f14944e9dc1b32496567e13a0add300b9407781d0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounce-md_30503645.6a638a4f.v1-d19811414ae6401b87c02826474dda27@mandrillapp.com

Date

Fri, 24 Jul 2026 15:52:47 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBZb3UndmUgYmVlbiBpbnZpdGVkIHRvIFJpZ1Vw?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17895833769360.6647040495284219"

Received

from IA6PR16MB7032.namprd16.prod.outlook.com (2603:10b6:208:5da::16) by BL0PR16MB2612.namprd16.prod.outlook.com with HTTPS; Fri, 24 Jul 2026 15:54:13 +0000

from DS7PR06CA0008.namprd06.prod.outlook.com (2603:10b6:8:2a::15) by IA6PR16MB7032.namprd16.prod.outlook.com (2603:10b6:208:5da::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Fri, 24 Jul 2026 15:52:47 +0000

from DS2PEPF00003446.namprd04.prod.outlook.com (2603:10b6:8:2a:cafe::29) by DS7PR06CA0008.outlook.office365.com (2603:10b6:8:2a::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.12 via Frontend Transport; Fri, 24 Jul 2026 15:52:47 +0000

from mail179-17.suw41.mandrillapp.com (198.2.179.17) by DS2PEPF00003446.mail.protection.outlook.com (10.167.17.73) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Fri, 24 Jul 2026 15:52:47 +0000

from mta004-md-use2.delv.a.intuit.com (localhost [127.0.0.1]) by mail179-17.suw41.mandrillapp.com (Mailchimp) with ESMTP id 4h6CDv1ljnz3jwH for <[email protected]>; Fri, 24 Jul 2026 15:52:47 +0000 (UTC)

from [34.68.124.34] by mandrillapp.com id d19811414ae6401b87c02826474dda27; Fri, 24 Jul 2026 15:52:47 +0000

Received-Spf

Pass (protection.outlook.com: domain of mandrillapp.com designates 198.2.179.17 as permitted sender) receiver=protection.outlook.com; client-ip=198.2.179.17; helo=mail179-17.suw41.mandrillapp.com; pr=C

Message-Id

<30503645.20260724155247.6a638a4f338c26.68056352@mail179-17.suw41.mandrillapp.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://mandrillapp.com/track/click/30503645/accounts.rigup.com?p=eyJzIjoiZnJXbVFQZVpXUkVGV0lKRUtZbUNmNmpsSnpBIiwidiI6MiwicCI6IntcInVcIjozMDUwMzY0NSxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FjY291bnRzLnJpZ3VwLmNvbVxcXC91XFxcL3Jlc2V0LXZlcmlmeT90aWNrZXQ9VXRGdjVBbGxSN3JaTG9rek5jOUE0V01Mb0RPV2F0cU8jaW52aXRlPXRydWVcIixcImlkXCI6XCJkMTk4MTE0MTRhZTY0MDFiODdjMDI4MjY0NzRkZGEyN1wiLFwidXJsX2lkc1wiOltcImNmOTJiMDE5Y2EzMzkxYWNmYjRhNzNiNzYyYjg0ZDBkYzNlNGY0YTlcIl0sXCJtc2dfdHNcIjoxNzg0OTA4MzY3fSJ9

  • file https://mandrillapp.com/track/click/30503645/www.rigup.com?p=eyJzIjoiY3pETlRRU3l2ZTJkQ2NJY3lQalRkb3FzZFpVIiwidiI6MiwicCI6IntcInVcIjozMDUwMzY0NSxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5yaWd1cC5jb21cIixcImlkXCI6XCJkMTk4MTE0MTRhZTY0MDFiODdjMDI4MjY0NzRkZGEyN1wiLFwidXJsX2lkc1wiOltcIjcyYTM3ZTBlZjJjZGIyNzNkMjIxOGEyODI5OGY2MTZmZTgzZTljMzdcIl0sXCJtc2dfdHNcIjoxNzg0OTA4MzY3fSJ9