Overview

overview

4

Static

static

1

Potential ...1).eml

windows10-2004-x64

4

Potential ...1).eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (21).eml
  • Size 44KB
  • Sample261023-2vtyzagw2j
  • SHA256 3f66a99db578e032158a3d51df41565c23ee624f25d4e0c5cbc0c1f1f00f3e9d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Potential Phish (21).eml
    .eml 44KB
  • email-html-2.txt
    .html 19KB
  • email-plain-1.txt
    2KB

Potential Phish (21).eml

  • SHA256 3f66a99db578e032158a3d51df41565c23ee624f25d4e0c5cbc0c1f1f00f3e9d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 15 Oct 2026 14:11:00 +0000 (UTC)

Subject

[External] Expecting your FCA invoice soon? Don't wait to prepare

Content-Type

multipart/alternative; boundary="===============3203909982465838988=="

Received

from LOEP265MB690924.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:501::17) by LODP265MB066013.GBRP265.PROD.OUTLOOK.COM with HTTPS; Thu, 15 Oct 2026 14:18:08 +0000

from CYZPR10CA0021.namprd10.prod.outlook.com (2603:10b6:930:8a::14) by LOEP265MB690924.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:501::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.14; Thu, 15 Oct 2026 14:18:07 +0000

from DM4PR03MB5999.namprd03.prod.outlook.com (2603:10b6:930:8a:cafe::37) by CYZPR10CA0021.outlook.office365.com (2603:10b6:930:8a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Thu, 15 Oct 2026 14:18:03 +0000

from BL1PR13CA0349.namprd13.prod.outlook.com (2603:10b6:208:2c6::24) by DM4PR03MB5999.namprd03.prod.outlook.com (2603:10b6:5:38a::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.14; Thu, 15 Oct 2026 14:14:56 +0000

from BN3PEPF00022BBD.namprd04.prod.outlook.com (2603:10b6:208:2c6:cafe::6a) by BL1PR13CA0349.outlook.office365.com (2603:10b6:208:2c6::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.6 via Frontend Transport; Thu, 15 Oct 2026 14:14:56 +0000

from man3ppp001.assurant.com (167.79.18.50) by BN3PEPF00022BBD.mail.protection.outlook.com (10.167.248.117) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Thu, 15 Oct 2026 14:14:56 +0000

from pps.filterd (man3appcp001.assurant.com [127.0.0.1]) by man3appcp001.assurant.com (8.18.1.11/8.18.1.11) with ESMTP id 69FDO1222685966 for <[email protected]>; Thu, 15 Oct 2026 15:14:52 +0100

from ord3appcp003.assurant.com ([10.31.16.12]) by man3appcp001.assurant.com (PPS) with ESMTPS id 4h82pya3r7-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Thu, 15 Oct 2026 15:14:42 +0100 (BST)

from pps.filterd (ord3appcp003.assurant.com [127.0.0.1]) by ord3appcp003.assurant.com (8.18.1.11/8.18.1.11) with ESMTP id 69FDOFpI1973078 for <[email protected]>; Thu, 15 Oct 2026 10:14:41 -0400

from esa-live-esa2.en04.com (esa-live-esa2.en04.com [91.199.181.58]) by ord3appcp003.assurant.com (PPS) with ESMTPS id 4haypf8gbn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Thu, 15 Oct 2026 10:14:40 -0400 (EDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning premiumcredit.en04.com discourages use of 167.79.18.50 as permitted sender)

X-Mailer

Enabler - http://www.enablermail.com

Message-Id

<[email protected]>

Extracted URLs

  • file http://www.fca.pcl.co.uk

  • file https://ue.enablermail.com/premiumcredit/clickthru.cfm?chid=Oi4pTVZEXyJPPUFAXClBPTwpIS9cIAo&id=3679

  • file https://ue.enablermail.com/premiumcredit/clickthru.cfm?chid=Oi4pTVZEXyJPPUFAXClBPTwpIS9cIAo&id=6415

  • file https://ue.enablermail.com/premiumcredit/clickthru.cfm?chid=Oi4pTVZEXyJPPUFAXClBPTwpIS9cIAo&private=1

  • file https://ue.enablermail.com/premiumcredit/clickthru.cfm?chid=Oi4pTVZEXyJPPUFAXClBPTwpIS9cIAo&private=5

  • file https://www.fca.org.uk/firms/fees)

  • file https://www.fca.pcl.co.uk/?utm_source=premiumcredit&utm_medium=email&utm_campaign=prospect2026&utm_content=prospect8