General

  • Target
    phish_alert_sp2_2.0.0.0 - 2026-09-22T090347.370.eml
  • Size 553KB
  • Sample260922-rdpyksga59
  • SHA256 a0bef777709be1b7cc8ad4e9cc83a90c5748dd895390725552d06b1412bdd984
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • phish_alert_sp2_2.0.0.0 - 2026-09-22T090347.370.eml
    .eml 553KB
  • Scanned from a Xerox Multifunction Printer.pdf
    .pdf 396KB
  • email-plain-1.txt
    490B

phish_alert_sp2_2.0.0.0 - 2026-09-22T090347.370.eml

  • SHA256 a0bef777709be1b7cc8ad4e9cc83a90c5748dd895390725552d06b1412bdd984
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 22 Sep 2026 08:55:02 -0400

Subject

=?UTF-8?B?U2Nhbm5lZCBmcm9tIGEgWGVyb3ggTXVsdGlmdW5jdGlvbiBQcmlu?= =?UTF-8?B?dGVy?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17900845263950.8509133172602901"

Received

from SJ0PR09MB6480.namprd09.prod.outlook.com (::1) by SA9PR09MB5055.namprd09.prod.outlook.com with HTTPS; Tue, 22 Sep 2026 13:21:47 +0000

from CYXPR09CA0010.namprd09.prod.outlook.com (2603:10b6:930:d4::15) by SJ0PR09MB6480.namprd09.prod.outlook.com (2603:10b6:a03:266::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.14; Tue, 22 Sep 2026 13:21:09 +0000

from SJ1PEPF000037B0.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::98) by CYXPR09CA0010.outlook.office365.com (2603:10b6:930:d4::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.14 via Frontend Transport; Tue, 22 Sep 2026 13:21:09 +0000

from SMTP02.AZ.MSG.VIRGINIA.GOV (20.124.6.105) by SJ1PEPF000037B0.mail.protection.outlook.com (10.167.242.132) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Tue, 22 Sep 2026 13:21:08 +0000

from [10.1.0.150] (port=28437 helo=MTA01.AZ.MSG.VIRGINIA.GOV) by SMTP02.AZ.MSG.VIRGINIA.GOV with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99.5) (envelope-from <[email protected]>) id 1x90Ql-00000002YZo-45Fq for [email protected]; Tue, 22 Sep 2026 13:21:07 +0000

from [10.1.0.150] (port=34523 helo=PA-GTBINS-01) by MTA01.AZ.MSG.VIRGINIA.GOV with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99.5) (envelope-from <[email protected]>) id 1x90Ql-00000001l5x-3ePB for [email protected]; Tue, 22 Sep 2026 13:21:07 +0000

from [10.1.0.150] (helo=MTA01.AZ.MSG.VIRGINIA.GOV) by PA-GTBINS-01 with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96.2) (envelope-from <[email protected]>) id 1x90Pz-0008dG-35 for [email protected]; Tue, 22 Sep 2026 13:21:07 +0000

from gmr01.vita.virginia.gov ([166.67.201.136]:48812 helo=gmr01.cov.virginia.gov) by MTA01.AZ.MSG.VIRGINIA.GOV with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99.5) (envelope-from <[email protected]>) id 1x90QJ-00000001kof-0H0U for [email protected]; Tue, 22 Sep 2026 13:20:39 +0000

from XRX9C934E9E11BB.cov.virginia.gov (unknown [10.174.122.196]) by gmr01.cov.virginia.gov (Postfix) with ESMTP id 72582C004E2 for <[email protected]>; Tue, 22 Sep 2026 09:20:36 -0400 (EDT)

Received-Spf

Pass (protection.outlook.com: domain of cov.virginia.gov designates 20.124.6.105 as permitted sender) receiver=protection.outlook.com; client-ip=20.124.6.105; helo=SMTP02.AZ.MSG.VIRGINIA.GOV; pr=C

X-Mailer

Xerox Mailer /4.03

Message-Id

<a5m7ztXuP6pd8dvxH9Yx6uGoW.1790081699.11@XRX9C934E9E11BB.cov.virginia.gov>

Extracted URLs

  • file http://www.xerox.com

  • file https://aka.ms/LearnAboutSenderIdentification