OP thought it was from his "friend" SHA1 ... but SHA1 is just part of the PGP that the scammer copied and pasted around the scam message.