Overview

overview

5

Static

static

5

IT DEVICES...P1.pdf

windows10-2004-x64

3

IT DEVICES...P1.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (23).eml
  • Size 158KB
  • Sample260930-sxpbtsybld
  • SHA256 6759ceba1edbfdee2b3e9be3bd23458cd3492428ef885ada383b91e341e52b0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf

File Explorer

  • phish_alert_sp2_2.0.0.0 (23).eml
    .eml 158KB
  • IT DEVICES DOC LVR4KC13P1.pdf
    .pdf 97KB
  • email-html-1.txt
    .html 9KB

phish_alert_sp2_2.0.0.0 (23).eml

  • SHA256 6759ceba1edbfdee2b3e9be3bd23458cd3492428ef885ada383b91e341e52b0b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 30 Sep 2026 14:25:10 +0000

Subject

=?UTF-8?B?SVQgREVWSUNFUyBmaWxlIGF0dGFjaGVkIFN1Ym1pc3Npb24gIFdl?= =?UTF-8?B?ZG5lc2RheSBTZXB0ZW1iZXI=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17907783522840.22928965325018524"

Received

from PH0PR03MB6336.namprd03.prod.outlook.com (2603:10b6:510:bf::13) by DM6PR03MB3801.namprd03.prod.outlook.com with HTTPS; Wed, 30 Sep 2026 14:25:23 +0000

from SA1P222CA0180.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:3c4::17) by PH0PR03MB6336.namprd03.prod.outlook.com (2603:10b6:510:bf::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.16; Wed, 30 Sep 2026 14:25:20 +0000

from SA2PEPF00003AE7.namprd02.prod.outlook.com (2603:10b6:806:3c4:cafe::46) by SA1P222CA0180.outlook.office365.com (2603:10b6:806:3c4::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.15 via Frontend Transport; Wed, 30 Sep 2026 14:25:20 +0000

from SJ2PR03CU001.outbound.protection.outlook.com (2a01:111:f403:c001::2) by SA2PEPF00003AE7.mail.protection.outlook.com (2603:10b6:80f:fc04::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 14:25:19 +0000

from DM4PR19MB8301.namprd19.prod.outlook.com (2603:10b6:8:b3::6) by DM3PR19MB8360.namprd19.prod.outlook.com (2603:10b6:0:4b::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Wed, 30 Sep 2026 14:25:11 +0000

from DM4PR19MB8301.namprd19.prod.outlook.com ([fe80::f85e:d94:acf4:4e67]) by DM4PR19MB8301.namprd19.prod.outlook.com ([fe80::f85e:d94:acf4:4e67%5]) with mapi id 15.21.0472.015; Wed, 30 Sep 2026 14:25:11 +0000

Received-Spf

Pass (protection.outlook.com: domain of itdevicesonline.com designates 2a01:111:f403:c001::2 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c001::2; helo=SJ2PR03CU001.outbound.protection.outlook.com; pr=C

Message-Id

<DM4PR19MB8301FFE68B32BD0F6CCB9E16C08B2@DM4PR19MB8301.namprd19.prod.outlook.com>