General
-
Target
Secure_Message_06096.pdf
-
Size
31KB
-
MD5
31643e96ca1ebab8adda5e1d6409a555
-
SHA1
ce07fbf57b5dca8cb966fc35f855ef0b9acade82
-
SHA256
7983a17df6186c8ef7936a8e33ffd8fd21c8c86a0702008c8c4a52150c6324c8
-
SHA512
3f66d79a6448eaa453115166c2e7c028989b29cdb29f90cc3a184bc17f3082e371f1bfacca3d5791d14da114d6489bf48a0bea1ab76c5f3f9a50b5a4759e5aea
-
SSDEEP
768:bVg9lZiDmirdbf4ss2hnXv/qroooPk5XpqKqHVUXX:bVwymipbQVInX3Vc55TqHVUXX
Malware Config
Signatures
-
PDF has QR code that contains a HTTP URL
PDFs with URL QR codes are often used for phishing
-
One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
Files
-
Secure_Message_06096.pdf
-
https://dk7k6.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbazcMBPWMx/4DPjftHKMEpvc3F1YXR0bGViYXVtQGVoc3RlZWwuY29t
-
https://go.microsoft.com/fwlink/?Linkid=844050
-
https://go.microsoft.com/fwlink/p/?linkid=857875
-
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=agoldaracena%40toroam.us&senderemailaddress=fconcha%40lumafintech.com&senderorganization=AwGHAAAAAoMAAAADAQAAANKLtWd%2FKeVDlK7N0yQMk3JPVT1hdGxhc3RyYWRlcHJvY29tLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIwMUEwMDgsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTTDYf%2F9zFhVChQtkCWVdZaFDTj1Db25maWd1cmF0aW9uLENOPWF0bGFzdHJhZGVwcm9jb20ub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjAxQTAwOCxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3D%3D&messageid=%3CCO1PR01MB65840854F6DCB30725C39986B56B9%40CO1PR01MB6584.prod.exchangelabs.com%3E&cfmRecipient=SystemMailbox%7BD0E409A0-AF9B-4720-92FE-AAC869B0D201%7D%40atlastradeprocom.onmicrosoft.com&consumerEncryption=false&senderorgid=c77ea6ac-eb43-4cae-b8ac-50d838c4a9a4&urldecoded=1&e4e_sdata=Gx9733U48YJ0v%2BqRHygZsVCVsFng%2F1VefnUUsrl6KBTHfP37Pj6mc5BBwGje2nr%2Bw6AMqXazv8reZMcqtxPVuQEZDb3Qx7%2BX2XfbBNSeXkBXyc%2F%2BBCQgNRiMKud3VbVHOixjNGrZ%2FnvqJvWcGwI9wdQ6U20Er5vlBrXIZb4L0RmyIdBfVZKGyVDk6Zny7mxu3CW7rou9rEEBF3RTEsiYVkTBG81dCsoS3QtacakiVhpTYndgjOHki9Ua%2F%2BHJPXSJxnDdcLQwInDU5LmqI13ZWhCajo9D%2BrH3EfA2om4Q0cSsMUSs%2FNHmKDLP4rt4W9z4doe3cBOeuvULqvjKjzZEjA%3D%3D
-