Overview

overview

10

Static

static

1

RFQ_305041...ico.js

windows10-2004-x64

10

RFQ_305041...ico.js

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5ef7f8dd-5255-35c8-5046-35fb9ae64a6c.eml
  • Size 118KB
  • Sample260506-vaej8aew8z
  • SHA256 d8dff8762f591e068fa32c5cf0cd26f83b944d7c657e7e42b811192103950778
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 5ef7f8dd-5255-35c8-5046-35fb9ae64a6c.eml
    .eml 118KB
  • =?utf-8?Q?RFQ=5F305041=5F04302026=5FDanfei=5Fde=5FM=C3=A9xico=2EGz?=
    .gz 44KB
  • RFQ_305041_04302026_Danfei_de_México.js
    2.0MB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    1KB
  • image001.jpg
    .jpg 13KB
  • image002.jpg
    .jpg 8KB

5ef7f8dd-5255-35c8-5046-35fb9ae64a6c.eml

  • SHA256 d8dff8762f591e068fa32c5cf0cd26f83b944d7c657e7e42b811192103950778
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

[email protected]

Return-Path

[email protected]

Date

Fri, 1 May 2026 02:02:11 +0700 (WIB)

Subject

Urgent - RFQ#305041// (EXP ready date 30 JUN 2026)

Content-Type

multipart/mixed; boundary="----=_Part_63789_39377705.1777575731491"

Received

from AS4P191CA0052.EURP191.PROD.OUTLOOK.COM (2603:10a6:20b:657::25) by DBAPR03MB6392.eurprd03.prod.outlook.com (2603:10a6:10:192::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9870.20; Thu, 30 Apr 2026 19:23:51 +0000

from AM2PEPF0001C711.eurprd05.prod.outlook.com (2603:10a6:20b:657:cafe::92) by AS4P191CA0052.outlook.office365.com (2603:10a6:20b:657::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9870.22 via Frontend Transport; Thu, 30 Apr 2026 19:23:51 +0000

from mail.ga-in.co.id (202.43.115.150) by AM2PEPF0001C711.mail.protection.outlook.com (10.167.16.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9870.22 via Frontend Transport; Thu, 30 Apr 2026 19:23:50 +0000

from localhost (localhost [127.0.0.1]) by mail.ga-in.co.id (Postfix) with ESMTP id 356DD1E9C28B; Fri, 1 May 2026 02:02:19 +0700 (WIT)

from mail.ga-in.co.id ([127.0.0.1]) by localhost (mail.ga-in.co.id [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id cHteNMK4SpvP; Fri, 1 May 2026 02:02:18 +0700 (WIT)

from localhost (localhost [127.0.0.1]) by mail.ga-in.co.id (Postfix) with ESMTP id 7A3CF1E9C249; Fri, 1 May 2026 02:02:14 +0700 (WIT)

from mail.ga-in.co.id ([127.0.0.1]) by localhost (mail.ga-in.co.id [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id sJCHGWfbVzFt; Fri, 1 May 2026 02:02:14 +0700 (WIT)

from mail.ga-in.co.id (mail.ga-in.co.id [202.43.115.150]) by mail.ga-in.co.id (Postfix) with ESMTP id D7C591E9C0D7; Fri, 1 May 2026 02:02:11 +0700 (WIT)

Received-Spf

Pass (protection.outlook.com: domain of ga-in.co.id designates 202.43.115.150 as permitted sender) receiver=protection.outlook.com; client-ip=202.43.115.150; helo=mail.ga-in.co.id; pr=C

X-Mailer

Zimbra 8.0.7_GA_6021 (ZimbraWebClient - GC147 (Win)/8.0.7_GA_6021)

Message-Id

<[email protected]>