A Trusted Domain, a Voicemail, and a Windows .EXE

A voicemail-themed phishing email sent from a legitimately authenticated nonprofit account contained six benign links and one malicious link that directly downloaded a Windows executable (hmlineea.exe) from a newly registered, privacy-masked domain (db2000.net); because the sender's domain passed SPF/DKIM/DMARC, reputation checks gave it a pass, and behavioral/file analysis was required to detect and quarantine the threat.