ExternalStoperations Take Action Today 2026 Performance Review[.]msg

General

Target
ExternalStoperations Take Action Today 2026 Performance Review.msg
Size 200KB
Sample260512-c381esdx6t
SHA256 f7885a68aa38e829777e48dd365e713eb802ec86f6f94b2a68ccb432c25cb2bc
MD5 f136d1369a872747da1edd566935f658
SHA1 e779cfc8b22c8bd77654152dcba67f12b22efdab
SHA512 576e35d5f5b7d4a82c83416a0653028196c2e361f0c654db411f81a8263f0a7b7f2d186299a5c86e04c8b39dc5b2186347b0985c1bbbbb6cfec5e07cec4e0c8e
SSDEEP 3072:MpmPazKmj39yPVmtf7HRy5j9+3fI8ZdrShBUj/5JBubq:hmj39h9P5v7Hk
TLSH
T1AF140A2439EA5119F1B3DF358AE660A7952BBD53AD25564F3095330E0A72840ECA3F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

pdf link qr

Malware Config

Signatures

PDF has QR code that contains a HTTP URL
PDFs with URL QR codes are often used for phishing
pdf qr
One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

File Explorer

ExternalStoperations Take Action Today 2026 Performance Review.msg

.msg 200KB
s&[email protected]_Appraisal_22218.pdf

.pdf 88KB

ExternalStoperations Take Action Today 2026 Performance Review.msg

SHA256 f7885a68aa38e829777e48dd365e713eb802ec86f6f94b2a68ccb432c25cb2bc
MD5 f136d1369a872747da1edd566935f658
SHA1 e779cfc8b22c8bd77654152dcba67f12b22efdab
SHA512 576e35d5f5b7d4a82c83416a0653028196c2e361f0c654db411f81a8263f0a7b7f2d186299a5c86e04c8b39dc5b2186347b0985c1bbbbb6cfec5e07cec4e0c8e
SSDEEP 3072:MpmPazKmj39yPVmtf7HRy5j9+3fI8ZdrShBUj/5JBubq:hmj39h9P5v7Hk
TLSH
T1AF140A2439EA5119F1B3DF358AE660A7952BBD53AD25564F3095330E0A72840ECA3F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

s&[email protected]

From

[email protected]

Return-Path

[email protected]

Date

Mon, 11 May 2026 06:39:50 -0700 (PDT)

Subject

=?utf-8?q?=5BExternal=5DS=26toperations_Take_Action_Today_=E2=80=93_2026_?= =?utf-8?q?Performance_Review?=

Content-Type

multipart/mixed; boundary="===============66488218762657237638=="

Received

from PN0P287MB1859.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:18b::14) by PN4P287MB4754.INDP287.PROD.OUTLOOK.COM with HTTPS; Mon, 11 May 2026 13:40:27 +0000

from MA0PR01CA0075.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:ad::16) by PN0P287MB1859.INDP287.PROD.OUTLOOK.COM (2603:1096:c01:18b::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.23; Mon, 11 May 2026 13:40:21 +0000

from MA1PEPF00007262.INDPRD01.PROD.OUTLOOK.COM (2603:1096:a01:ad:cafe::29) by MA0PR01CA0075.outlook.office365.com (2603:1096:a01:ad::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.23 via Frontend Transport; Mon, 11 May 2026 13:40:21 +0000

from exedge.ril.com (116.50.96.179) by MA1PEPF00007262.mail.protection.outlook.com (10.167.242.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.13 via Frontend Transport; Mon, 11 May 2026 13:40:21 +0000

from SIDCEX19MBX27.in.ril.com (10.129.54.31) by exedge.ril.com (10.129.79.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.25; Mon, 11 May 2026 19:10:09 +0530

from SIDCEX19MBX25.in.ril.com (10.129.54.39) by SIDCEX19MBX27.in.ril.com (10.129.54.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.39; Mon, 11 May 2026 19:10:08 +0530

from SJDCINPOSTFIX02.ril.com (10.129.6.62) by SIDCEX19MBX25.in.ril.com (10.129.54.39) with Microsoft SMTP Server id 15.2.1258.39 via Frontend Transport; Mon, 11 May 2026 19:10:08 +0530

from SJDCIRMFEX03.in.ril.com (unknown [10.21.33.10]) by SJDCINPOSTFIX02.ril.com (Postfix) with ESMTP id 92A80A0069 for <s&[email protected]>; Mon, 11 May 2026 19:10:08 +0530 (IST)

from localhost.localdomain (localhost [127.0.0.1]) by SJDCIRMFEX03.in.ril.com (Postfix) with SMTP id 4gDgp03dgbz74l0C for <s&[email protected]>; Mon, 11 May 2026 19:10:08 +0530 (IST)

from GWJGSMTP30.ril.com (unknown [10.21.4.141]) by SJDCIRMFEX03.in.ril.com (Postfix) with ESMTP id 4gDgnn2JhMz74l1m for <s&[email protected]>; Mon, 11 May 2026 19:09:57 +0530 (IST)

from mail-pj1-f99.google.com ([209.85.216.99]) by GWJGSMTP30.ril.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 11 May 2026 19:09:54 +0530

by mail-pj1-f99.google.com with SMTP id 98e67ed59e1d1-3653cb9c6f8so3629635a91.0 for <s&[email protected]>; Mon, 11 May 2026 06:39:54 -0700 (PDT)

from [100.64.100.6] ([92.119.36.45]) by smtp-relay.gmail.com with ESMTP id 98e67ed59e1d1-367d63e0535sm741250a91.6.2026.05.11.06.39.50 for <s&[email protected]>; Mon, 11 May 2026 06:39:50 -0700 (PDT)

X-Received

by 2002:a17:90a:d886:b0:35b:8d89:719b with SMTP id 98e67ed59e1d1-365ab3e592amr24488650a91.1.1778506790910; Mon, 11 May 2026 06:39:50 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning pcaballero.com discourages use of 116.50.96.179 as permitted sender)

None (GWJGSMTP30.ril.com: no sender authenticity information available from domain of [email protected]) identity=pra; client-ip=209.85.216.99; receiver=GWJGSMTP30.ril.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible

Pass (GWJGSMTP30.ril.com: domain of [email protected] designates 209.85.216.99 as permitted sender) identity=mailfrom; client-ip=209.85.216.99; receiver=GWJGSMTP30.ril.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all"

None (GWJGSMTP30.ril.com: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=209.85.216.99; receiver=GWJGSMTP30.ril.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible

Message-Id

<[email protected]>

Sharing