Overview

overview

5

Static

static

5

phish_aler....0.eml

windows10-2004-x64

1

phish_aler....0.eml

windows11-ltsc_2024-x64

1

adj_179399...00.svg

windows10-2004-x64

3

adj_179399...00.svg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    phish_alert_sp2_2.0.0.0.eml
  • Size 11.5MB
  • Sample261107-vm6t8sdv2y
  • SHA256 f5ab2cb55f5e279159a8d3ecc16ecc3f73d3420472799e9ad55c94230f8e92c6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
svgjavascript

Malware Config

Signatures

  • Suspicious SVG script tag 1 IoCs
    svgjavascript
  • SVG contains script element(s) 1 IoCs
    svgjavascript

File Explorer

  • phish_alert_sp2_2.0.0.0.eml
    .eml 11.5MB
  • adj_1793997763562782500.svg
    .svg .xml 8.4MB
  • email-html-1.txt
    .html 8KB

phish_alert_sp2_2.0.0.0.eml

  • SHA256 f5ab2cb55f5e279159a8d3ecc16ecc3f73d3420472799e9ad55c94230f8e92c6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 6 Nov 2026 20:55:05 +0000

Subject

=?UTF-8?B?UmVxdWVyaW1pZW50byB2Mw==?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17940533885980.845494547673654"

Received

from LV3PR16MB6771.namprd16.prod.outlook.com (::1) by DS0PR16MB656770.namprd16.prod.outlook.com with HTTPS; Fri, 6 Nov 2026 20:58:51 +0000

from BLAPR03CA0142.namprd03.prod.outlook.com (2603:10b6:208:32e::27) by LV3PR16MB6771.namprd16.prod.outlook.com (2603:10b6:408:26a::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.11; Fri, 6 Nov 2026 20:55:19 +0000

from BN5PEPF00046988.namprd02.prod.outlook.com (2603:10b6:208:32e:cafe::13) by BLAPR03CA0142.outlook.office365.com (2603:10b6:208:32e::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.11 via Frontend Transport; Fri, 6 Nov 2026 20:55:19 +0000

from DM1PR04CU001.outbound.protection.outlook.com (52.101.61.143) by BN5PEPF00046988.mail.protection.outlook.com (10.167.245.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.4 via Frontend Transport; Fri, 6 Nov 2026 20:55:19 +0000

from SCYPR80MB7110.lamprd80.prod.outlook.com (2603:10d6:300:a7::13) by SCRPR80MB998184.lamprd80.prod.outlook.com (2603:10d6:300:183::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.11; Fri, 6 Nov 2026 20:55:06 +0000

from SCYPR80MB7110.lamprd80.prod.outlook.com ([fe80::e229:c4a5:1f40:c08f]) by SCYPR80MB7110.lamprd80.prod.outlook.com ([fe80::e229:c4a5:1f40:c08f%4]) with mapi id 15.21.0592.010; Fri, 6 Nov 2026 20:55:05 +0000

Received-Spf

Pass (protection.outlook.com: domain of grupodonjulio.com designates 52.101.61.143 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.61.143; helo=DM1PR04CU001.outbound.protection.outlook.com; pr=C

Message-Id

<SCYPR80MB71108CE99316DD1D400B473AA9762@SCYPR80MB7110.lamprd80.prod.outlook.com>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification