phish_alert_sp2_2[.]0[.]0[.]0 - 2026-10-23T154307[.]612[.]eml

General

Target
phish_alert_sp2_2.0.0.0 - 2026-10-23T154307.612.eml
Size 370KB
Sample261023-q54elsda47
SHA256 a5adcee7003428b6c2901c597f116a6a1aac496c0d4bf17f4cd024c9865e93b6
MD5 e27cbf28b8d2b02babbad5667894e0aa
SHA1 fb1714af5fae89bb5af964f97a92ce8e24889273
SHA512 4ce16bdc6711c95a7a6d7bdf233e9488f07bf5989a0d99da27b97d141ec67dd16aa0f8d856c29638d85f1b588ea2452c569ff0cfa916ed7f4112592748a8bc71
SSDEEP 6144:vkrfSb0zPx1iZHfeHh955c1ZqtIgg0GJrx9lXqKJEEwuCJ6ibEbzzCej4esMH2c:mfrt8ZHWHQ1gti19x95qKJEGibkzGej/
TLSH
T174840253F6CA2C958E1B49607967B6B93F3815DA9F36093581EE7B3917CEC82D382403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

phish_alert_sp2_2.0.0.0 - 2026-10-23T154307.612.eml

.eml 370KB
EmailSignature.png

.png 251KB
email-html-1.txt

.html 15KB

phish_alert_sp2_2.0.0.0 - 2026-10-23T154307.612.eml

SHA256 a5adcee7003428b6c2901c597f116a6a1aac496c0d4bf17f4cd024c9865e93b6
MD5 e27cbf28b8d2b02babbad5667894e0aa
SHA1 fb1714af5fae89bb5af964f97a92ce8e24889273
SHA512 4ce16bdc6711c95a7a6d7bdf233e9488f07bf5989a0d99da27b97d141ec67dd16aa0f8d856c29638d85f1b588ea2452c569ff0cfa916ed7f4112592748a8bc71
SSDEEP 6144:vkrfSb0zPx1iZHfeHh955c1ZqtIgg0GJrx9lXqKJEEwuCJ6ibEbzzCej4esMH2c:mfrt8ZHWHQ1gti19x95qKJEGibkzGej/
TLSH
T174840253F6CA2C958E1B49607967B6B93F3815DA9F36093581EE7B3917CEC82D382403
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

bounces+[email protected]

Date

Fri, 23 Oct 2026 12:02:55 +0000 (UTC)

Subject

24 HOURS NOTICE

Content-Type

multipart/related; boundary=6f2a63c0f450667ebcba51dba9e366cfc4041377eb1eee992563c32da4dc

Received

from JN5P275MB3570.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:eb::20) by JN6P275MB3467.ZAFP275.PROD.OUTLOOK.COM with HTTPS; Fri, 23 Oct 2026 12:03:05 +0000

from PA7P264CA0138.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:377::14) by JN5P275MB3570.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:eb::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.4; Fri, 23 Oct 2026 12:02:58 +0000

from AM7PEPF00000053.EURPRD83.prod.outlook.com (2603:10a6:102:377:cafe::85) by PA7P264CA0138.outlook.office365.com (2603:10a6:102:377::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.19 via Frontend Transport; Fri, 23 Oct 2026 12:02:57 +0000

from o4.ptr1503.nudebt.co.za (159.183.26.137) by AM7PEPF00000053.mail.protection.outlook.com (10.167.242.39) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.0 via Frontend Transport; Fri, 23 Oct 2026 12:02:56 +0000

by recvd-canary-56d76dbc6f-dzr8h with SMTP id recvd-canary-56d76dbc6f-dzr8h-1-6ADB4CEF-7E 2026-10-23 12:02:55.328892658 +0000 UTC m=+2055742.217050706

from MjcxNjU5MTM (unknown) by geopod-ismtpd-9 (SG) with HTTP id _WaPPQwXRyiGuRxXcEKxWQ Fri, 23 Oct 2026 12:02:55.262 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of em5024.nudebt.co.za designates 159.183.26.137 as permitted sender) receiver=protection.outlook.com; client-ip=159.183.26.137; helo=o4.ptr1503.nudebt.co.za; pr=C

Message-Id

<_WaPPQwXRyiGuRxXcEKxWQ@geopod-ismtpd-9>

Extracted URLs

file https://aka.ms/LearnAboutSenderIdentification

Sharing