Overview

overview

5

Static

static

5

Automation...re.pdf

windows10-2004-x64

3

Automation...re.pdf

windows11-ltsc_2024-x64

3

Flare Syst...et.pdf

windows10-2004-x64

3

Flare Syst...et.pdf

windows11-ltsc_2024-x64

3

MISSION FL...26.pdf

windows10-2004-x64

3

MISSION FL...26.pdf

windows11-ltsc_2024-x64

3

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (34).eml
  • Size 5.4MB
  • Sample260930-s9zy4ayfla
  • SHA256 d7990345bc7103c68ec868e81fc15a2d36ed9d382270006ce956f5ef08eb2aab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdflink

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • phish_alert_sp2_2.0.0.0 (34).eml
    .eml 5.4MB
  • Automation Services Brochure.pdf
    .pdf 2.0MB
  • Flare System Data Sheet.pdf
    .pdf 86KB
  • MISSION FLARES COMBUSTION Partial Summary 2026.pdf
    .pdf 1.4MB
  • email-html-1.txt
    .html 13KB
  • image001.png
    .png 439KB

phish_alert_sp2_2.0.0.0 (34).eml

  • SHA256 d7990345bc7103c68ec868e81fc15a2d36ed9d382270006ce956f5ef08eb2aab
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

SJ0PR08MB6781592B27EB12995F4C5C8DAE812@SJ0PR08MB6781.namprd08.prod.outlook.com

Return-Path

[email protected]

Date

Wed, 30 Sep 2026 15:24:19 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBIaWxjb3JwIH4gTUlTU0lPTiBDb21idXN0aW9u?= =?UTF-8?B?IC8gVmFwb3IgUmVjb3ZlcnkgLyBBdXRvbWF0aW9uIFNPTFVUSU9O?= =?UTF-8?B?UyA=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17907832446830.6135679028078531"

Received

from CH3PR16MB6086.namprd16.prod.outlook.com (::1) by MN2PR16MB3230.namprd16.prod.outlook.com with HTTPS; Wed, 30 Sep 2026 15:25:40 +0000

from CH0P221CA0015.NAMP221.PROD.OUTLOOK.COM (2603:10b6:610:11c::25) by CH3PR16MB6086.namprd16.prod.outlook.com (2603:10b6:610:1b4::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Wed, 30 Sep 2026 15:24:25 +0000

from BL6PEPF00022572.namprd02.prod.outlook.com (2603:10b6:610:11c:cafe::41) by CH0P221CA0015.outlook.office365.com (2603:10b6:610:11c::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Wed, 30 Sep 2026 15:24:25 +0000

from CY3PR05CU001.outbound.protection.outlook.com (2a01:111:f403:c112::7) by BL6PEPF00022572.mail.protection.outlook.com (2603:10b6:20f:fc04::128) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Wed, 30 Sep 2026 15:24:24 +0000

from PH0PR08MB6774.namprd08.prod.outlook.com (2603:10b6:510:3d::13) by BN0PR08MB7438.namprd08.prod.outlook.com (2603:10b6:408:151::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Wed, 30 Sep 2026 15:24:19 +0000

from PH0PR08MB6774.namprd08.prod.outlook.com ([fe80::d1cd:e07e:4c24:787f]) by PH0PR08MB6774.namprd08.prod.outlook.com ([fe80::d1cd:e07e:4c24:787f%5]) with mapi id 15.21.0451.026; Wed, 30 Sep 2026 15:24:19 +0000

Received-Spf

Pass (protection.outlook.com: domain of missionflares.com designates 2a01:111:f403:c112::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c112::7; helo=CY3PR05CU001.outbound.protection.outlook.com; pr=C

Message-Id

<PH0PR08MB6774D26080CED774835A3A65AE8B2@PH0PR08MB6774.namprd08.prod.outlook.com>

Extracted URLs

  • file http://www.missionflares.com/

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://www.linkedin.com/in/charlie-gasper-5657671?lipi=urn%3Ali%3Apage%3Ad_flagship3_profile_view_base_contact_details%3BZEfI%2FCCMQQqAyg0I3szlqA%3D%3D