phish_alert_sp2_2[.]0[.]0[.]0[.]eml

General

Target
phish_alert_sp2_2.0.0.0.eml
Size 170KB
Sample261001-m3vsxa1sc1
SHA256 efbafb456639373e2309208a4ae2da455afb8f3034c2601ca5c479dfd2d9d112
MD5 a33217a83b04516f9359b18b00096780
SHA1 48bbdbe9ca8fc8b04cffa1cf1def553068c933b6
SHA512 d6eedb31dfad0b04dced086e1ec0bee9f60c05d7b27a2f34372926e201e5850ff4f2feee19f5152e2900076055d64341a8a409e9d5683d8796b3a977ee2db3f4
SSDEEP 3072:sIVYp16/84GsHJ9rB/c9UoYGZN6W/EczYnRjAPs1rZ06NhbdR00IT:sIVYj6k4GS9rdcaoYG/ZEcMnqPpmkT
TLSH
T181040134BC051E8B8BF0E74971DFA8C060AF1F47468B19B2B074AA805ED6E51A3CAD5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

phish_alert_sp2_2.0.0.0.eml

.eml 170KB
Outlook-cmfaklpo.png

.png 19KB
Serenade Punta Cana.pdf

.pdf 86KB
email-html-1.txt

.html 8KB

phish_alert_sp2_2.0.0.0.eml

SHA256 efbafb456639373e2309208a4ae2da455afb8f3034c2601ca5c479dfd2d9d112
MD5 a33217a83b04516f9359b18b00096780
SHA1 48bbdbe9ca8fc8b04cffa1cf1def553068c933b6
SHA512 d6eedb31dfad0b04dced086e1ec0bee9f60c05d7b27a2f34372926e201e5850ff4f2feee19f5152e2900076055d64341a8a409e9d5683d8796b3a977ee2db3f4
SSDEEP 3072:sIVYp16/84GsHJ9rB/c9UoYGZN6W/EczYnRjAPs1rZ06NhbdR00IT:sIVYj6k4GS9rdcaoYG/ZEcMnqPpmkT
TLSH
T181040134BC051E8B8BF0E74971DFA8C060AF1F47468B19B2B074AA805ED6E51A3CAD5D
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

From

[email protected]

Return-Path

[email protected]

Date

Tue, 29 Sep 2026 16:15:49 +0000

Subject

=?UTF-8?B?Rm9ybXVsYXJpbyBkZSBIb3NwaXRhbGlkYWQ=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17906987567220.21781785075765014"

Received

from PH7PR16MB6073.namprd16.prod.outlook.com (2603:10b6:510:302::10) by LV2PR16MB7117.namprd16.prod.outlook.com with HTTPS; Tue, 29 Sep 2026 16:17:18 +0000

from CH0PR03CA0253.namprd03.prod.outlook.com (2603:10b6:610:e5::18) by PH7PR16MB6073.namprd16.prod.outlook.com (2603:10b6:510:302::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Tue, 29 Sep 2026 16:15:58 +0000

from BN2PEPF0000449F.namprd02.prod.outlook.com (2603:10b6:610:e5:cafe::69) by CH0PR03CA0253.outlook.office365.com (2603:10b6:610:e5::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 16:15:56 +0000

from CY3PR05CU001.outbound.protection.outlook.com (40.93.201.108) by BN2PEPF0000449F.mail.protection.outlook.com (10.167.243.150) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 16:15:55 +0000

from PH7PR10MB7783.namprd10.prod.outlook.com (2603:10b6:510:2ff::8) by IA1PR10MB8211.namprd10.prod.outlook.com (2603:10b6:208:463::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14; Tue, 29 Sep 2026 16:15:51 +0000

from PH7PR10MB7783.namprd10.prod.outlook.com ([fe80::86f4:3864:e5d2:717b]) by PH7PR10MB7783.namprd10.prod.outlook.com ([fe80::86f4:3864:e5d2:717b%6]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 16:15:50 +0000

Received-Spf

Pass (protection.outlook.com: domain of serenade.do designates 40.93.201.108 as permitted sender) receiver=protection.outlook.com; client-ip=40.93.201.108; helo=CY3PR05CU001.outbound.protection.outlook.com; pr=C

Message-Id

<PH7PR10MB77832D525B1A7697FDA32525DC8C2@PH7PR10MB7783.namprd10.prod.outlook.com>

Extracted URLs

file http://www.serenadepuntacana.com/

Sharing