Quarantined Messages[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Quarantined Messages.zip
Size

123KB
MD5

068266fdbd133fc77bb418e98da90098
SHA1

39b99ea5626f9e3335a4bd21bbf3bb122bb824d0
SHA256

938a34f299aa4f7988f3bdcf7647faec1867b173c1002a08d8a006de02df5319
SHA512

b9724160c83ab6e5b6e7c985b4a4c85b54164a0fb2ee777dbcf5a67c8a0481113258e627cc2f3b9cde0f60f9b8ff6f6a040f7a9484e1f4744c0f7c62d03feec2
SSDEEP

3072:DYZjl3ecUR6bPi10sRgonrmxYIfl9WJxnWnveZtp0fx5Dp:DoR3xGuY0sRgQK9W30vMqp

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

resource	yara_rule
static1/unpack002/China Railway N9 Group Co. Ltd. Venezuela C.A FACTURA DE PA_GO.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Files

Quarantined Messages.zip
.zip

Password: 123456
bd2292af-20f4-4ddb-12de-08dc85644cef/82c2bb21-0ba9-acd5-d58e-1d1c0015430d.eml
.eml
Password: 123456
- https://aka.ms/LearnAboutSenderIdentification
China Railway N9 Group Co. Ltd. Venezuela C.A FACTURA DE PA_GO.pdf
.pdf
Password: 123456
- http://surl.li/ufyev
email-html-2.txt
.html
email-plain-1.txt