General

  • Target

    QHSE_ Dept of Natl Defense _CAD Gvmt - Tender 180881.eml

  • Size

    3.0MB

  • MD5

    75f74d4b77ab456624fd229cf66505cb

  • SHA1

    5a68e4b17808e6027923900b44a2e87b723bfd0b

  • SHA256

    e57f78c2cc8ab0000909e33c1a27c8df7fceb5bbefca1282b8e4a1cde8644cb5

  • SHA512

    0865df20da7ee1079b72c68c50864172d3642ec002f5b94efd056a7803f76d5247ef8a73c1aeb8173b04818cc3cd5c5510d75c02809d4af3b20f68e37c1ee02d

  • SSDEEP

    49152:W8MmY2OhjCaAB1cQspwVYPizjUG9M6Jth6DkPRob:i

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

Files

  • QHSE_ Dept of Natl Defense _CAD Gvmt - Tender 180881.eml
    .eml
    • http://www.wfscorp.com/

  • CADGvmt_Tender180881_BidLocations_Incumbent_04Mar2024.xls
    .xls windows office2003
  • E60HL-240050-A RFSO Into-plane Aviation Fuel NMSO 2024-2026.pdf
    .pdf
    • https://buyandsell.gc.ca/policy-and-guidelines/standard-acquisition-clauses-and-conditions-manual/

    • https://buyandsell.gc.ca/policy-and-guidelines/standard-acquisition-clauses-and-conditions-manual/1/2006/19

    • http://www.tpsgc-pwgsc.gc.ca/ongc-cgsb/index-eng.html/

    • https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32573

    • https://www.scc.ca/en/agl-csa

    • https://www.ul.com/

    • https://fsc.org/en

    • https://www.irc.inuvialuit.com/business/inuvialuit-business-list-ibl

    • https://www.gwichin.biz/registered-businesses.html

    • Show all
  • email-html-2.txt
  • email-plain-1.txt