General

  • Target
    phish_alert_sp2_2.0.0.0 (1).eml
  • Size 49KB
  • Sample261020-11ldcaav9k
  • SHA256 17b973c6a88c03369ba68559e88800dfc731fc5f085f8e01901baf199c7ee710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (1).eml
    .eml 49KB
  • 03b43cf3-0e55-4e00-a7d5-fb2a89c30622
    .png 2KB
  • 2576d959-6b5a-4156-932b-1e00633e8653
    .png 4KB
  • 9c7c13f3-4133-4857-b458-9f98f06725ab
    .png 560B
  • ea79656a-88b1-4402-bfce-9d1a69fc52ba
    .png 787B
  • email-html-1.txt
    .html 17KB

phish_alert_sp2_2.0.0.0 (1).eml

  • SHA256 17b973c6a88c03369ba68559e88800dfc731fc5f085f8e01901baf199c7ee710
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 20 Oct 2026 19:43:05 +0000

Subject

=?UTF-8?B?W0VYVEVSTkFMXSBBbGFuIFZhenF1ZXogc2hhcmVkICJFNjI2OS1E?= =?UTF-8?B?Ql9NYW51YWwiIHdpdGggeW91?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17925331979070.8755105182974349"

Received

from SA1PR16MB7105.namprd16.prod.outlook.com (2603:10b6:806:4a1::13) by MW3PR16MB3881.namprd16.prod.outlook.com with HTTPS; Tue, 20 Oct 2026 19:54:13 +0000

from SJ0PR05CA0130.namprd05.prod.outlook.com (2603:10b6:a03:33d::15) by SA1PR16MB7105.namprd16.prod.outlook.com (2603:10b6:806:4a1::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.19; Tue, 20 Oct 2026 19:53:53 +0000

from BY1PEPF00026957.namprd05.prod.outlook.com (2603:10b6:a03:33d:cafe::5c) by SJ0PR05CA0130.outlook.office365.com (2603:10b6:a03:33d::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 19:53:53 +0000

from mx0b-0004f803.pphosted.com (205.220.182.179) by BY1PEPF00026957.mail.protection.outlook.com (10.167.244.167) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 19:53:52 +0000

from pps.filterd (m0357537.ppops.net [127.0.0.1]) by mx0a-0004f803.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69KGvp3S365583 for <[email protected]>; Tue, 20 Oct 2026 14:53:52 -0500

from aromailexp12.cat.com (aromailexp12.cat.com [165.26.50.73]) by mx0a-0004f803.pphosted.com (PPS) with ESMTPS id 4heaj6upxm-24 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 20 Oct 2026 14:53:51 -0500 (CDT)

from pps.filterd (aromailexp12.cat.com [127.0.0.1]) by aromailexp12.cat.com (8.18.1.7/8.18.1.7) with ESMTP id 69KJZ4Dh087651 for <[email protected]>; Tue, 20 Oct 2026 14:43:08 -0500

from arlmailp03.cis.cat.com (arwissvmailp07.mw.na.cat.com [10.55.21.174]) by aromailexp12.cat.com (PPS) with ESMTP id 4hdw5dvhdg-1 for <[email protected]>; Tue, 20 Oct 2026 14:43:08 -0500 (CDT)

from aromailexp01.cat.com (aromailexp01.cat.com [165.26.50.21]) by arlmailp03.cis.cat.com (8.15.1/8.15.1) with ESMTP id 69KJh71b052896 for <[email protected]>; Tue, 20 Oct 2026 14:43:07 -0500

from pps.filterd (aromailexp01.cat.com [127.0.0.1]) by aromailexp01.cat.com (8.18.1.7/8.18.1.7) with ESMTP id 69KJK8Kn029876 for <[email protected]>; Tue, 20 Oct 2026 14:43:07 -0500

from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11010021.outbound.protection.outlook.com [40.93.198.21]) by aromailexp01.cat.com (PPS) with ESMTPS id 4hdw5cbdks-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 20 Oct 2026 14:43:07 -0500 (CDT)

from CH0PR08MB6969.namprd08.prod.outlook.com (2603:10b6:610:c6::18) by DS0PR08MB10989.namprd08.prod.outlook.com (2603:10b6:8:2f6::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 19:43:05 +0000

from CH0PR08MB6969.namprd08.prod.outlook.com ([fe80::fc17:690d:d98:2110]) by CH0PR08MB6969.namprd08.prod.outlook.com ([fe80::fc17:690d:d98:2110%6]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 19:43:05 +0000

Received-Spf

Pass (protection.outlook.com: domain of solarturbines.com designates 205.220.182.179 as permitted sender) receiver=protection.outlook.com; client-ip=205.220.182.179; helo=mx0b-0004f803.pphosted.com; pr=C

Message-Id

<Share-a763bc60-75f8-40c0-a7f3-04c4d0074ad2.rcid_38d046a2-30ff-2000-4b6b-61aaa7d5628d.wiid_cedcc472-9212-46e2-aaeb-b3c1351ba08d-ioe_1-tid_ceb177bf-013b-49ab-8a9c-4abce32afc1e-rh_cae_notifyp-aid_37a6af42-56fd-457d-86f0-a02b078cf965@odspnotify>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://caterpillar.sharepoint.com/:u:/r/teams/PRU_CommissioningGroup/Shared%20Documents/OMI%20Project%20Files/E6269-DB_Manual.zip?e=4%3af2a4aebb2e1e49fd9d5a9b850ac33533&web=1&sharingv2=true&fromShare=true&at=9

  • file https://caterpillar.sharepoint.com/teams/PRU_CommissioningGroup/Shared%20Documents/OMI%20Project%20Files/E6269-DB_Manual.zip?e=4%3af2a4aebb2e1e49fd9d5a9b850ac33533&web=1&openShare=true&fromShare=true&at=9

  • file https://www.caterpillar.com/dataprivacy