General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 115KB
  • Sample261012-ygkllaee49
  • SHA256 f16619d7bb52b2e6b8e513e5ed46865b60868cdf9aefb1409aa910d2d3af7460
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 115KB
  • email-html-1.txt
    .html 9KB
  • job_info_request_WO18284877.pdf
    .pdf 71KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 f16619d7bb52b2e6b8e513e5ed46865b60868cdf9aefb1409aa910d2d3af7460
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 8 Oct 2026 09:30:03 -0400

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBXL08gMTgyODQ4NzcgfCBKb2IgSW5mbyBSZXF1?= =?UTF-8?B?ZXN0IFBhZ2U=?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17918333294280.522573665269532"

Received

from PH0PR16MB5184.namprd16.prod.outlook.com (2603:10b6:510:29b::5) by MN2PR16MB3343.namprd16.prod.outlook.com with HTTPS; Thu, 8 Oct 2026 13:32:53 +0000

from CYXPR02CA0022.namprd02.prod.outlook.com (2603:10b6:930:cf::26) by PH0PR16MB5184.namprd16.prod.outlook.com (2603:10b6:510:29b::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.15; Thu, 8 Oct 2026 13:32:12 +0000

from DM2PEPF00003FC6.namprd04.prod.outlook.com (2603:10b6:930:cf:cafe::30) by CYXPR02CA0022.outlook.office365.com (2603:10b6:930:cf::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Thu, 8 Oct 2026 13:32:12 +0000

from mail.nationwidenotice.com (8.38.79.88) by DM2PEPF00003FC6.mail.protection.outlook.com (10.167.23.25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.14 via Frontend Transport; Thu, 8 Oct 2026 13:32:11 +0000

from WIN-STSE93ASIVST (UnknownHost [192.168.1.204]) by mail.nationwidenotice.com with SMTP; Thu, 8 Oct 2026 13:32:00 +0000

Received-Spf

Pass (protection.outlook.com: domain of nationwidenotice.com designates 8.38.79.88 as permitted sender) receiver=protection.outlook.com; client-ip=8.38.79.88; helo=mail.nationwidenotice.com; pr=C

X-Mailer

ColdFusion 9 Application Server

Message-Id

<768909119.76161.1791466203065.JavaMail.Administrator@mail.nationwidenotice.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://www.nationwidenotice.com