Urget Contract Action[.]eml

Sharing

Copy URL Twitter E-mail

General

Target
Urget Contract Action.eml
Size 604KB
Sample260618-s68f3ahs8l
SHA256 c5fe32e5de97a1c0ff01c7bcbc99d7086a485b6df9ac7cdb37e906f6e1d01da3
MD5 048c02e929690bcb0a537d08e71f6b50
SHA1 e35f34239708f1d2ac63dc88366dcb3686d0d1eb
SHA512 bd942387e85c4981cba4617089728958e7bf163efb73ee5624e3f5e409552426a3ee67d0900bca18dc089552d5c855ca99dbf5115f4293eb5162e346a68fcaa9
SSDEEP 12288:G35ETPjPNu1JoTIIu4Q3H3KNgrYq/6lm2pNRs/P7IunP9m4QSmWveSI:PPDkreIItQqev/Qmofs/TdnPvPpeB
TLSH
T118D4123E49C2ABCB07329CBF50457A9ABC84D35B6956210093ECA2233E657F0976D4FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
unpack001/Urgent Contract Action.pdf.exe

File Explorer

Urget Contract Action.eml

.eml 604KB
Urgent Contract Action.pdf.exe

.exe 431KB
email-html-2.txt

4KB
email-plain-1.txt

3KB

Urget Contract Action.eml

SHA256 c5fe32e5de97a1c0ff01c7bcbc99d7086a485b6df9ac7cdb37e906f6e1d01da3
MD5 048c02e929690bcb0a537d08e71f6b50
SHA1 e35f34239708f1d2ac63dc88366dcb3686d0d1eb
SHA512 bd942387e85c4981cba4617089728958e7bf163efb73ee5624e3f5e409552426a3ee67d0900bca18dc089552d5c855ca99dbf5115f4293eb5162e346a68fcaa9
SSDEEP 12288:G35ETPjPNu1JoTIIu4Q3H3KNgrYq/6lm2pNRs/P7IunP9m4QSmWveSI:PPDkreIItQqev/Qmofs/TdnPvPpeB
TLSH
T118D4123E49C2ABCB07329CBF50457A9ABC84D35B6956210093ECA2233E657F0976D4FD
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

Delivered-To

[email protected]

From

[email protected]

Sender

=?utf-8?B?RHJ1bWJvwq4=?= <[email protected]>

Return-Path

[email protected]

Date

Fri, 13 Dec 2024 22:27:38 +0000

Subject

Immediate Action Required: Your Employment Contract.

Content-Type

multipart/mixed; boundary="--_=_NextPart887_c9b48180-2a98-41f6-b723-6678633baac4"

Received

by 2002:a05:6674:6783:b0:5c7:9645:8cca with SMTP id vl3csp820661pxc; Fri, 13 Dec 2024 14:27:39 -0800 (PST)

from dezoeteinval.co.za (vps-fa2b00d6.vps.ovh.net. [51.195.254.223]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-5d652f81b7dsi311467a12.471.2024.12.13.14.27.38 for <[email protected]> (version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128); Fri, 13 Dec 2024 14:27:39 -0800 (PST)

from spruce-goose-ax.twitter.com (spruce-goose-ax.twitter.com. [199.59.150.93])

from efianalytics.com (efianalytics.com. 216.244.76.116)

X-Received

by 2002:a05:6402:354f:b0:5d0:e2c8:dc8d with SMTP id 4fb4d7f45d1cf-5d63c33bafamr4543368a12.20.1734128859131; Fri, 13 Dec 2024 14:27:39 -0800 (PST)

Received-Spf

pass (google.com: domain of [email protected] designates 51.195.254.223 as permitted sender) client-ip=51.195.254.223;

Message-Id

<1419576.bWFhcmtrbm9wZmxlckBnbWFpbC5jb20=@iobBeE5>

Urgent Contract Action.pdf.exe

IMPHASH e3bda9df66f1f9b2b9b7b068518f2af1
SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
MD5 fbbdc39af1139aebba4da004475e8839
SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
TLSH
T1199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c9:13:30:16:a3:e5:cf:bf:b1:aa:8b:50:d1:16:0f:a5:35:73:41:3d:4f:81:f8:71:05:4e:c7:39:6d:5a:8b:17

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Chains

Sep 8, 2017

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

bd:ae:90:d3:3b:42:bf:69:31:7c:f4:d9:c1:9d:fd:c2:69:86:ca:f0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Chains

Sep 8, 2017

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Serial Number

0e:bf:ea:68:d6:77:b3:e2:6c:ab:41:c3:3f:3e:69:de

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 16, 2016 - Dec 17, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Serial Number

2e:6b:e6:bd:11:a8:67:6e:6c:57:90:9e:9b:0d:5f:57

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2017 - Apr 13, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2014 - Jul 21, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

4800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Urget Contract Action.eml

Email Headers

Urgent Contract Action.pdf.exe

PE Signature issue

PE Signature issue

kernel32

user32

shell32

msvcrt

generic

email-html-2.txt

email-plain-1.txt