phish_alert_sp2_2[.]0[.]0[.]0[.]eml

Resubmissions

12/10/2026, 19:14

261012-xxvwtsd13w6

12/10/2026, 19:04

261012-xq9fmswt2n6

Sharing

Copy URL Twitter E-mail

General

Target
phish_alert_sp2_2.0.0.0.eml
Size 39KB
Sample261012-xq9fmswt2n
SHA256 ca6cfe05b1aef5d1c1dc887a5b8c8572cbfa3d301e480f36819e863a29f12ca2
MD5 ed65a623342237ad4d56f853f5be4a05
SHA1 7f363a4ce312e3109b6fc7a408c585cc27fbe555
SHA512 b7076b37fe018d5b688259aa3152369cb0e59c37fc8b54c3f1602b5ccbd717347680efb36f596a883f0fadc3a16b8b970750d239744713a95eda9b34ca7dab4f
SSDEEP 768:zPqSmK8dtU470OL2RFEWRNPMd/HM1NTbawyr/cINjBcqDSAWB1D7s295EOFXbtVo:b8tU470FeWRNPMd/HINTba/r/cIhBcq9
TLSH
T1BA034D33AC1A0C973F2E6B5F964BFD456815E3B72CD311E83A9A826844A653D05DC32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

pdf evasion

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

File Explorer

phish_alert_sp2_2.0.0.0.eml

.eml 39KB
Grainger Quotation Confirmation 2066096609.PDF

.pdf 21KB
email-plain-1.txt

227B

phish_alert_sp2_2.0.0.0.eml

SHA256 ca6cfe05b1aef5d1c1dc887a5b8c8572cbfa3d301e480f36819e863a29f12ca2
MD5 ed65a623342237ad4d56f853f5be4a05
SHA1 7f363a4ce312e3109b6fc7a408c585cc27fbe555
SHA512 b7076b37fe018d5b688259aa3152369cb0e59c37fc8b54c3f1602b5ccbd717347680efb36f596a883f0fadc3a16b8b970750d239744713a95eda9b34ca7dab4f
SSDEEP 768:zPqSmK8dtU470OL2RFEWRNPMd/HM1NTbawyr/cINjBcqDSAWB1D7s295EOFXbtVo:b8tU470FeWRNPMd/HINTba/r/cIhBcq9
TLSH
T1BA034D33AC1A0C973F2E6B5F964BFD456815E3B72CD311E83A9A826844A653D05DC32F
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

[email protected]

Return-Path

010f01a1313a9867-47174609-1129-41da-92f2-6bc8726a149b-000000@sapses.grainger.com

Date

Mon, 12 Oct 2026 17:48:06 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBHcmFpbmdlciBRdW90YXRpb24gMjA2NjA5NjYw?= =?UTF-8?B?OSAxMC8xMi8yMDI2?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17918273695680.25838949991753923"

Received

from SA1PR16MB6316.namprd16.prod.outlook.com (2603:10b6:806:3d0::7) by IA1PR16MB5261.namprd16.prod.outlook.com with HTTPS; Mon, 12 Oct 2026 17:48:23 +0000

from BL1PR13CA0183.namprd13.prod.outlook.com (2603:10b6:208:2be::8) by SA1PR16MB6316.namprd16.prod.outlook.com (2603:10b6:806:3d0::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.21; Mon, 12 Oct 2026 17:48:06 +0000

from BN2PEPF0000A88E.namprd04.prod.outlook.com (2603:10b6:208:2be:cafe::1c) by BL1PR13CA0183.outlook.office365.com (2603:10b6:208:2be::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Mon, 12 Oct 2026 17:48:06 +0000

from e226-50.smtp-out.us-east-2.amazonses.com (23.251.226.50) by BN2PEPF0000A88E.mail.protection.outlook.com (10.167.248.180) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Mon, 12 Oct 2026 17:48:06 +0000

Received-Spf

Pass (protection.outlook.com: domain of sapses.grainger.com designates 23.251.226.50 as permitted sender) receiver=protection.outlook.com; client-ip=23.251.226.50; helo=e226-50.smtp-out.us-east-2.amazonses.com; pr=C

X-Mailer

SAP NetWeaver 740

Message-Id

<010f01a1313a9867-47174609-1129-41da-92f2-6bc8726a149b-000000@us-east-2.amazonses.com>

Extracted URLs

file https://aka.ms/LearnAboutSenderIdentification