50f1af96-4c72-b144-595c-8768025d700f[.]eml

50f1af96-4c72-b144-595c-8768025d700f.eml

SHA256 6ae463315e69a5f41a77eec4ad364990f89a5c42ee450b7724c89c689d42a7f3
MD5 1de6eee777333efa9f5b96fa143ae517
SHA1 5cc43827e8027dbbc537a43186379b8f1575067f
SHA512 e39e5de38fa462f6048a060f03f9f6991fc6a08878119a751da81256227a5cb14a0038e3daee58ebb2d71e91560eb13bd2d2679fd6e6f01905735f5286f4e8da
SSDEEP 49152:AgdrTt36qfOcezH9EvFVFtWmEdKYSIdeA78rHdWMkfIrjGSVz1lz2US8ILb5zUV8:a
TLSH
T146F62338998926DF0911E2FAF216B89471DD63CB0C83075743BCC6F535FA4A49B63CA6
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

SI4PR03MB9866835C8E8854EDDC8351AF94FF2@SI4PR03MB9866.apcprd03.prod.outlook.com

Date

Wed, 8 Jul 2026 14:39:55 +0000

Subject

RE: TOPL Prophix Excel Add-In

Content-Type

multipart/mixed; boundary="_008_SEZPR01MB4399F3FBB75AC534B12B8199E5FF2SEZPR01MB4399apcp_"

Received

from SEZPR01MB4399.apcprd01.prod.exchangelabs.com (2603:1096:101:4f::13) by JH0PR01MB5870.apcprd01.prod.exchangelabs.com (2603:1096:990:45::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.11; Wed, 8 Jul 2026 14:39:56 +0000

from SEZPR01MB4399.apcprd01.prod.exchangelabs.com ([fe80::fa7b:b19f:e19e:ed75]) by SEZPR01MB4399.apcprd01.prod.exchangelabs.com ([fe80::fa7b:b19f:e19e:ed75%6]) with mapi id 15.21.0181.010; Wed, 8 Jul 2026 14:39:56 +0000

Message-Id

<SEZPR01MB4399F3FBB75AC534B12B8199E5FF2@SEZPR01MB4399.apcprd01.prod.exchangelabs.com>

Extracted URLs

file http://www.adventus.com/
file https://aka.ms/AAb9ysg
file https://aka.ms/LearnAboutSenderIdentification
file https://ap.sansan.com/v/vc/bbabdwzoyekenkvhfnsgpke2oa/
file https://cescorp.conso.ap.prophix.cloud/cr
file https://outlook.office.com/bookwithme/user/[email protected]?anonymous&ismsaljsauthenabled&ep=pcard

Prophix.FinancialConsolidation.Setup.Exe.ExcelAddin-25.1.1.0+d7211bd.zip

SHA256 45d480bfee0ca3994469eeeddc6e93d4d1023305f68fad2fa43475737335b582
MD5 89baae0a4274fbf38c9d5be87e25d768
SHA1 4ae3349686a27f6532062c053e7a13b8fe4619f2
SHA512 5870f347748a1873f8ee820045ed227b0fd520f90831674597e4dab60b24ff64085fb6acd4796177a54bde48be876ecff2d45cf71ee39b8a32bf772c4edcf33d
SSDEEP 196608:qruVfgXQ/+3fxpMFFgMro/wTH6iaZTtzkZf1zvHpn1JUbFMfKDAfxl/VufZgl:qruVqQ2PXPYTH6n5toR1rHpn1jfKDAfr
TLSH
T1EBC633EFB3F5004E403C7D740B689419526032AD7617A7B476724EF8638687BAEF85B2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Prophix Conso Excel Add-in Installation Guide.pdf

SHA256 33c7d9f43cb9fd175c3a2cdc3ab22141146980a9d4d33596ea33ad13313d8590
MD5 009ebb51bcfb880f92f5b4f80252f75e
SHA1 a88420f7435358dd83be8c60eb8ac8175fc4ac63
SHA512 918f72818f1e4efb8e256c27f45404ea6cac4717017e66a8738e18733142cc822c068dca6647440e8740c76cf0486cbd4e4c4b2fbad83009cf5fc80c7d3cc736
SSDEEP 49152:0+e2DDKoObqAkG8aImxVuHSshWpuPJVvwN6q:0lrVr7fxVuHS8NPrDq
TLSH
T1327512074855DBCAE22442F53F072D0EB71B3E15B1C521E9316EBE9F6B32D268E8644E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Prophix.FinancialConsolidation.Setup.Exe.ExcelAddin-25.1.1.0+d7211bd.exe

IMPHASH 42d651751c1d75ed4fa8fe71751854ff
SHA256 f8dc49541be0db8d563af5925ce08b48b1f8c32815c634e8d3cc75506be02896
MD5 c9c86a847702e594c1e4d88bf1a20a65
SHA1 9581fe724121b94f87cac5817fe5688bf2b3a5ab
SHA512 ebe6e6945ae25be5428d5cf975642c15689d6745175121e862adfb2b86e55c0a36834d8d45f2487723165d39013c75831f2d5446a98808af9c88bc7179b0417f
SSDEEP 196608:vT9yzVPrw9n02ha5SVRkGKEkJkDQXPHJ9rp9xd8NV6nn6Yq/jeNo/vqGn:7IZjxYVRkL7kM/Hjrp9xHnn6Yqiu/n
TLSH
T1DAB633F263604022F1F509F36978DD312D3EA724E7118AB5D2D0BC5C7AB44A66BB7263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

infected

Digest

72:bb:83:1e:76:75:26:ef:ed:e4:b1:ce:98:85:2f:cd:11:47:65:17:d7:e6:48:52:91:55:0a:c4:71:b1:82:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Prophix Software Inc,OU=Cloud Operations,O=Prophix Software Inc,L=Mississauga,ST=Ontario,C=CA

Chains

Mar 14, 2025

CN=Prophix Software Inc,OU=Cloud Operations,O=Prophix Software Inc,L=Mississauga,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Prophix Software Inc,OU=Cloud Operations,O=Prophix Software Inc,L=Mississauga,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Prophix Software Inc,OU=Cloud Operations,O=Prophix Software Inc,L=Mississauga,ST=Ontario,C=CA

Serial Number

0c:3e:19:d7:83:04:71:41:52:37:7a:59:c6:fd:5d:8e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 4, 2023 - Dec 2, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

188273

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\66\s\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegQueryValueExW RegDeleteValueW CloseEventLog OpenEventLogW ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage GetMessageW TranslateMessage MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdi32

DeleteDC DeleteObject SelectObject StretchBlt GetObjectW CreateCompatibleDC

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CLSIDFromProgID CoInitializeSecurity

kernel32

GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileW GetProcAddress LocalFree HeapSetInformation GetLastError GetModuleHandleW FormatMessageW lstrlenA lstrlenW MultiByteToWideChar WideCharToMultiByte LCMapStringW Sleep GetLocalTime GetModuleFileNameW ExpandEnvironmentStringsW GetTempPathW GetTempFileNameW CreateDirectoryW GetFullPathNameW CompareStringW GetCurrentProcessId WriteFile SetFilePointer LoadLibraryW GetSystemDirectoryW CreateFileA HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindClose GetCommandLineA GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW GetCurrentProcess GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection ReleaseMutex TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask FreeLibrary EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo GetModuleHandleExW GetWindowsDirectoryW GetSystemWow64DirectoryW GetCommandLineW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetUserDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ReadFile SetFilePointerEx DuplicateHandle InterlockedExchange InterlockedCompareExchange LoadLibraryExW CreateEventW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers DecodePointer WriteConsoleW GetModuleHandleA GlobalAlloc GlobalFree GetFileSizeEx CopyFileW VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime GetTimeZoneInformation SystemTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery GetComputerNameW SetCurrentDirectoryW GetFileType GetACP ExitProcess GetStdHandle InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException LoadLibraryExA

rpcrt4

UuidCreate

email-html-2.txt

SHA256 6c5da36015cd3ac7c72f3a875461b48eabf00d29f81c2005ee343b2a185f7ab7
MD5 7d660bbf996ea56d465c8b8bf6ecb83f
SHA1 af91c6289f633995a0682289fbae75482b86e308
SHA512 f9a1285b21ab84309e41bfab312ddac0d134e3c819a0a13516e3d74263269393aff5119f7227fc02ecc14d6552852ef3e5d70eef9a3de2501c0f64204b2ffd13
SSDEEP 384:nKRct0DgDWDnL6e979A9f9PBlbXmzDyA5epuh8rOgTw+Lnml6BaGt2f8rU3SmLfe:nQOfbo8rfwww6gwve8
TLSH
T174E23426FB941D4395FE55F4D01B3B689095A3DE83120AF0B2AD357779CACA226C338D
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 3bd4c269d9a114ab21256a19c4186418a08c0e2ec18c7bcc0468ee3a48646b85
MD5 edccbd5c1590ac99d78957347f380840
SHA1 6eddbee3f23da6a8c339c6d9b3c4d23cab6ee123
SHA512 97a50184fff4c70ddec3eaea3fd0668210890d7adbe3b0aa99fb96677e47e19f18a7727967e166f1dca34604f3e020bc66f8e2ada4b5525064f9cff94025bd37
SSDEEP 96:dfQAnFaTYnE9HDHFo6LZr5zgIfs8bfSG0BG4qHjANV:dfjaTkEJZ1ZrhgIfs8bfDiG4qH0P
TLSH
T1B4B1759A6B0E33425F139A80B96E63EFB71812B59BB1D1C53879C416231183EFE554CE
MD5 SHA1 SHA512 SSDEEP TLSH

image001.jpg

SHA256 b4a80653c956629fc1163617a0da01228c82bf9ecfde574f87825fb608d4cc63
MD5 d89d9bdd1e778f18d65db6aed7126957
SHA1 738a26199e81f842f609e803f5269c8361558363
SHA512 041b3ec54020e3f8d325600c3fce2289410d2e38dc573e482630d7cdda3adf17b73c2b73d33b3280570ae08bd0fc874bda4aa25dd3774f7cd414d40d50ef509d
SSDEEP 192:LtHfTwrBQUotqhODgkO5JnrI7oK9nvA+rnBvBJhbhD:LtHf0ultqhOMTJqvjD
TLSH
T1C0E17E7C9406DC62D8D29CEF0084E666A3AFE6B864872722977FD1A475CC0F1331A53C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Extracted URLs

qr https://ap.sansan.com/v/vc/bbabdwzoyekenkvhfnsgpke2oa/

image002.png

SHA256 32b71014bb51097c0057d2e6cd90e7a5ad69a4bdd7b32f8b75b259269037917f
MD5 7110e188aae464c4000f86310967e047
SHA1 8c02beb6555255857c86bb73e56ec6a096a272b7
SHA512 445451243da3e156da4e404c9273bb1e59a422fc8bfe04071853ee772d4eed805c52599c168d488e74344ea19189cab3030405d61664a12fc723be83589f44d7
SSDEEP 384:KienRRkPyJS6qSxcd0LZ6pr3FgOGOuEvEN7hF9qkov3FSFw7LP6NRGPIgyy:KienjkPN6WF3FJuhN7L0vSFw7DPiy
TLSH
T104D2E003AC891D2383B69BBE38E9460C432B6D763BDFC90C0D0955A77A9DD28756DD22
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

image003.jpg

SHA256 301e99fcc30c4c85beeac4fe4a0d70f8a55787fda6c63f5432f7607cfe645eba
MD5 4b4f32d04afccb52a9b24d8656b88682
SHA1 ad35e79f8183659f5fec90af14f3e6f6b7d1ccd8
SHA512 b24e1dbf3ebb36b03ded4b4606f64d386adcc2a6a33a2fbea8222f6ca8bcd74087d46d57c7a856e640f05a6fdc6a1228e34e12760e2d2071173abb8b44e06ff6
SSDEEP 192:M2z7tvjwTRh/fBZUgbNgfqOGrmNWd7ndfluJWnA+FcLI59RBC0Y0R0CSCPFRQlTB:MeyNhxGgGfls988A+iwtlYStDdMt
TLSH
T1A4428EB3691013A5981CD1BFA2570F2BA9189696E6A06FCF07B80D57F1E0D439F9A04E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Sharing

General

Malware Config

Signatures

File Explorer

50f1af96-4c72-b144-595c-8768025d700f.eml

Email Headers

Extracted URLs

Prophix.FinancialConsolidation.Setup.Exe.ExcelAddin-25.1.1.0+d7211bd.zip

Prophix Conso Excel Add-in Installation Guide.pdf

Prophix.FinancialConsolidation.Setup.Exe.ExcelAddin-25.1.1.0+d7211bd.exe

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

rpcrt4

generic

email-html-2.txt

email-plain-1.txt

image001.jpg

Extracted URLs

image002.png

image003.jpg