Overview

overview

4

Static

static

1

phish_aler...3).eml

windows10-2004-x64

3

phish_aler...3).eml

windows11-ltsc_2024-x64

4

email-html-1.html

windows10-2004-x64

3

email-html-1.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0 (3).eml
  • Size 13KB
  • Sample261027-ma3ytab18z
  • SHA256 7c9ddde930e28ee46109b148da410e97707e61591cdf395eda8f50a6bfe3192e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (3).eml
    .eml 13KB
  • email-html-1.txt
    .html 4KB

phish_alert_sp2_2.0.0.0 (3).eml

  • SHA256 7c9ddde930e28ee46109b148da410e97707e61591cdf395eda8f50a6bfe3192e
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 21 Oct 2026 13:55:09 +0000

Subject

=?UTF-8?B?WW91ciByZXF1ZXN0IHdhcyBzdWNjZXNzZnVsbHkgY29tcGxldGVk?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17926083749190.6144087959337247"

Received

from DBAPR02MB6327.eurprd02.prod.outlook.com (2603:10a6:10:192::18) by GVXPR02MB12203.eurprd02.prod.outlook.com with HTTPS; Wed, 21 Oct 2026 13:55:13 +0000

from AS4PR09CA0019.eurprd09.prod.outlook.com (2603:10a6:20b:5d4::10) by DBAPR02MB6327.eurprd02.prod.outlook.com (2603:10a6:10:192::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.14; Wed, 21 Oct 2026 13:55:11 +0000

from ZR1PEPF0000E45D.eurprd04.prod.outlook.com (2603:10a6:20b:5d4:cafe::2d) by AS4PR09CA0019.outlook.office365.com (2603:10a6:20b:5d4::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Wed, 21 Oct 2026 13:55:10 +0000

from psm.knowbe4.com (52.49.235.189) by ZR1PEPF0000E45D.mail.protection.outlook.com (10.167.241.53) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Wed, 21 Oct 2026 13:55:10 +0000

Received-Spf

Pass (protection.outlook.com: domain of psm.knowbe4.com designates 52.49.235.189 as permitted sender) receiver=protection.outlook.com; client-ip=52.49.235.189; helo=psm.knowbe4.com; pr=C

Message-Id

<[email protected]>

Extracted URLs

  • file https://https.www.secure.kb4.io/XYU9oS29sWk9hZklMSkFQQ0VKeEZrYU1uM09zTnJybS9kcXIwVU9WZkRYeW14dEl0bGpZd1gwZStsK3VUMXJDem9USnkzVWZxR2h1S05rSUkyRmIxOUhMcUhCRnBUeC9wNjBhMm53ZHU5by9UTHJVcFNobzcrdkFCZ3NGTGhic1QzSlF6SjYwOVR2L1I4d2lERUpqcVVzeXhsUFhrbWZybHppVHJzTEpuR212VXBWTU1xa1Y3WmZ6cmd4Z2o1TWVqRzc4ajBBPT0tLXBrUkZRVFVTSHZlanR3cWstLVNjMlY1dGpvQWdxSm4wMTRyOWloMlE9PQ==?cid=478983961

  • file https://https.www.secure.kb4.io/XdTY2N3A4Z3FMQ0xkc1dFTUY3a3g3UERXRnJNVWhjclFMNjVCVjJkSk1OU2xFQ25iQkRVVlZSQUVkV21jU1ZNWm5hZ3pKaHhBZG5CU2tmTUFCZWRFdFA2K0xBUmpwMCtibkJGV0R0NVdzdTdEN1RnTjZjTTZSd0kzNnowZ1YyV0ZEV25tTXFIU1p1blY0K0k4bzRBZi9zcW94dGthUGNZR3F4VGJ5dzhyZTFpdVlnTHBIY0orNFNPWWJQLzNZVjBaRTBzdmd6OFZHeVNRa1E9PS0tZmNlUnBCSE9Fa2xNOW9PNi0tWm5CWHgyNEFOZlIyMmNEbnc1UG1QZz09?cid=478983961