suspected_phishing_email (61)[.]eml

General

Target
suspected_phishing_email (61).eml
Size 35KB
Sample261001-pkcwgsshph
SHA256 de0e7f75d08026b782c47777dc1c08ab2f9d746d16a819c4e150405a41971436
MD5 a51bd9cfc56ace594575fdaca3a225da
SHA1 b814dba0f7d5d7bc7e4637dbbccfc79b0926c217
SHA512 c5856060b676027669e83f4d02533ed29e0c55b81d2f2ea2a3b11c27dd85c6b949e3ab2b998b2a2696b790a3d23441db7bb4ae3b6b20f22755999bf047acc534
SSDEEP 768:LL/aVniUIPzUu6lBsyagy68M4Ih2cEurkgz5dV8aWyiQ:3/eOPIJqcb4gz5P8aiQ
TLSH
T1ABF22C27F6C0281925EB0C99A4573B7C3E7C5085E7A21FB47828BBBD6784DD3560863E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

suspected_phishing_email (61).eml

.eml 35KB
email-html-1.txt

.html 26KB

suspected_phishing_email (61).eml

SHA256 de0e7f75d08026b782c47777dc1c08ab2f9d746d16a819c4e150405a41971436
MD5 a51bd9cfc56ace594575fdaca3a225da
SHA1 b814dba0f7d5d7bc7e4637dbbccfc79b0926c217
SHA512 c5856060b676027669e83f4d02533ed29e0c55b81d2f2ea2a3b11c27dd85c6b949e3ab2b998b2a2696b790a3d23441db7bb4ae3b6b20f22755999bf047acc534
SSDEEP 768:LL/aVniUIPzUu6lBsyagy68M4Ih2cEurkgz5dV8aWyiQ:3/eOPIJqcb4gz5P8aiQ
TLSH
T1ABF22C27F6C0281925EB0C99A4573B7C3E7C5085E7A21FB47828BBBD6784DD3560863E
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

<>

Date

Thu, 01 Oct 2026 00:36:22 GMT

Wed, 30 Sep 2026 21:09:07 +0000

Subject

null

Content-Type

text/html; charset=UTF-8

Received

from SJ2PR13MB6117.namprd13.prod.outlook.com (2603:10b6:a03:4f8::10) by BY3PR13MB4852.namprd13.prod.outlook.com with HTTPS; Thu, 1 Oct 2026 00:36:21 +0000

from SJ2PR13MB6117.namprd13.prod.outlook.com (2603:10b6:a03:4f8::10) by SJ2PR13MB6117.namprd13.prod.outlook.com (2603:10b6:a03:4f8::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Thu, 1 Oct 2026 00:35:36 +0000

from SJ2PR13MB6117.namprd13.prod.outlook.com (2603:10b6:408:e7::26) by SJ2PR13MB6117.namprd13.prod.outlook.com (2603:10b6:408:e7::26) with MailboxResubmission by AntispamTT id 15.21.451.26; Thu, 1 Oct 2026 00:35:36 +0000

from BN2PEPF0000A991.namprd04.prod.outlook.com (2603:10b6:408:e7:cafe::4c) by BN0PR03CA0051.outlook.office365.com (2603:10b6:408:e7::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Wed, 30 Sep 2026 21:09:08 +0000

from a9-19.smtp-out.amazonses.com (54.240.9.19) by BN2PEPF0000A991.mail.protection.outlook.com (10.167.248.138) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 21:09:07 +0000

Received-Spf

Pass (protection.outlook.com: domain of amazonses.com designates 54.240.9.19 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.9.19; helo=a9-19.smtp-out.amazonses.com; pr=C

Message-Id

<010001a0f42652bf-6ecb5791-c227-42d3-9768-545efb274b5b-000000@email.amazonses.com>

Extracted URLs

file https://aka.ms/LearnAboutSenderIdentification
file https://clgyb04.na2.hubspotlinks.com/Ctc/DJ+113/clgYb04/VW0Z_t1kSVhtW7mZbPn6wDTpwW4Rs6st5Vk-QTM1--k83qn9qW7Y8-PT6lZ3mXN6fB-zgBH7MSW3VcPwv68RJxYW5rJXD97CpSB6W11GSb172h9V5W99b4vq61D7bpW6-G-gz4fXWSgW2ZdnQ_4FZqwNW5PC7jb3JY9PpVmnSlX4v133XW6pwbxW1dJDpkW3DCMFZ8ZD0L4W4_cbtH7fcgnSW2n-Lsc7c26NcW41-YzS4swQgbW99XSJw4K-b3PW3-BQSC7ywJ6_W5GdcZG92j-VSW6VxS1q8wC0KpW8hdWrC8XdVhxVbGgdZ9gz1T8W1Qc74J28GLJWV-QjB15xXJD3W20PwRs5_S8m2W97mgC42X16fqVmd90c3HGmYqW6WX9T_7j7j_mf7ssnl404
file https://web.nevadabuilders.org/external/wcpages/referral.aspx?ProfileID=91891&ReferralType=SNOT&URL=http:%5Cun.yaldram.com/

Resubmissions

Sharing