General

  • Target
    phish_alert_sp2_2.0.0.0 (47).eml
  • Size 372KB
  • Sample261014-pptpssc14v
  • SHA256 b5d258b46e44be9aba6e9da5d7dc568c430ff3a3c3a13bd250e17387d2e81c20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

File Explorer

  • phish_alert_sp2_2.0.0.0 (47).eml
    .eml 372KB
  • 2026-10-13 10-59.pdf
    .pdf 249KB
  • email-html-1.txt
    .html 11KB

phish_alert_sp2_2.0.0.0 (47).eml

  • SHA256 b5d258b46e44be9aba6e9da5d7dc568c430ff3a3c3a13bd250e17387d2e81c20
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 13 Oct 2026 16:00:48 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBQZXJtaWFuIDU2NjI3?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17919803798860.9580022187134501"

Received

from CH0PR16MB4362.namprd16.prod.outlook.com (2603:10b6:610:113::23) by SJ0PR16MB5173.namprd16.prod.outlook.com with HTTPS; Tue, 13 Oct 2026 16:01:15 +0000

from PH8PR02CA0045.namprd02.prod.outlook.com (2603:10b6:510:2da::33) by CH0PR16MB4362.namprd16.prod.outlook.com (2603:10b6:610:113::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.23; Tue, 13 Oct 2026 16:01:09 +0000

from SJ5PEPF00000207.namprd05.prod.outlook.com (2603:10b6:510:2da:cafe::49) by PH8PR02CA0045.outlook.office365.com (2603:10b6:510:2da::33) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Tue, 13 Oct 2026 16:01:03 +0000

from dispatch1-us1.ppe-hosted.com (148.163.129.48) by SJ5PEPF00000207.mail.protection.outlook.com (10.167.244.40) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Tue, 13 Oct 2026 16:01:01 +0000

from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11022074.outbound.protection.outlook.com [40.107.200.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1-us1.ppe-hosted.com (PPE Hosted ESMTP Server) with ESMTPS id 3064BC0009B for <[email protected]>; Tue, 13 Oct 2026 16:00:56 +0000 (UTC)

from BN0PR03CA0042.namprd03.prod.outlook.com (2603:10b6:408:e7::17) by DS0PR03MB590875.namprd03.prod.outlook.com (2603:10b6:8:4e8::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.12; Tue, 13 Oct 2026 16:00:54 +0000

from BL6PEPF0006C3E1.namprd02.prod.outlook.com (2603:10b6:408:e7:cafe::f) by BN0PR03CA0042.outlook.office365.com (2603:10b6:408:e7::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Tue, 13 Oct 2026 16:00:53 +0000

from us1-emailsignatures-cloud.codetwo.com (20.98.2.159) by BL6PEPF0006C3E1.mail.protection.outlook.com (10.167.249.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Tue, 13 Oct 2026 16:00:53 +0000

from DS2PR08CU001.outbound.protection.outlook.com (40.93.13.74) by us1-emailsignatures-cloud.codetwo.com with CodeTwo SMTP Server (TLS12) via SMTP; Tue, 13 Oct 2026 16:00:51 +0000

from LV2PR03MB091180.namprd03.prod.outlook.com (2603:10b6:408:3b4::7) by IA5PR03MB989607.namprd03.prod.outlook.com (2603:10b6:208:609::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.23; Tue, 13 Oct 2026 16:00:48 +0000

from LV2PR03MB091180.namprd03.prod.outlook.com ([fe80::b523:ea12:d9e1:c6dd]) by LV2PR03MB091180.namprd03.prod.outlook.com ([fe80::b523:ea12:d9e1:c6dd%5]) with mapi id 15.21.0522.011; Tue, 13 Oct 2026 16:00:48 +0000

Received-Spf

Pass (protection.outlook.com: domain of perental.net designates 148.163.129.48 as permitted sender) receiver=protection.outlook.com; client-ip=148.163.129.48; helo=dispatch1-us1.ppe-hosted.com; pr=C

Fail (protection.outlook.com: domain of perental.net does not designate 20.98.2.159 as permitted sender) receiver=protection.outlook.com; client-ip=20.98.2.159; helo=us1-emailsignatures-cloud.codetwo.com;

Message-Id

<[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://permianequipmentrentals.com/

  • file https://www.brhas.com

  • file https://www.facebook.com/ButchsRatHole

  • file https://www.linkedin.com/company/butch's-companies/