Overview

overview

8

Static

static

5

original_message.eml

windows10-2004-x64

3

original_message.eml

windows11-ltsc_2024-x64

8

=?UTF-8?B?...?=.pdf

windows10-2004-x64

3

=?UTF-8?B?...?=.pdf

windows11-ltsc_2024-x64

3

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    original_message.eml
  • Size 30KB
  • Sample260709-pyg3csby2z
  • SHA256 c80f066f0965918c5b9071ee9779971c5b8043282071b7b8cc30818ad5c53070
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf

File Explorer

  • original_message.eml
    .eml 30KB
  • =?UTF-8?B?Um9sbGVkQWxsb3lzU3RyZWFtd29vZFBpY2t1cF8wMDU0NDAucGRm?=
    .pdf 15KB
  • email-plain-1.txt
    208B

original_message.eml

  • SHA256 c80f066f0965918c5b9071ee9779971c5b8043282071b7b8cc30818ad5c53070
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 8 Jul 2026 18:34:28 -0500

Subject

Internet Fax Job

Content-Type

multipart/mixed; boundary="RS1tYWlsIENsaWVudA=="

Received

from SA1PR12MB8741.namprd12.prod.outlook.com (::1) by IA0PR12MB8715.namprd12.prod.outlook.com with HTTPS; Wed, 8 Jul 2026 23:35:10 +0000

from PH7PR03CA0002.namprd03.prod.outlook.com (2603:10b6:510:339::21) by SA1PR12MB8741.namprd12.prod.outlook.com (2603:10b6:806:378::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Wed, 8 Jul 2026 23:34:40 +0000

from SA2PEPF00003F66.namprd04.prod.outlook.com (2603:10b6:510:339:cafe::2e) by PH7PR03CA0002.outlook.office365.com (2603:10b6:510:339::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.10 via Frontend Transport; Wed, 8 Jul 2026 23:34:40 +0000

from OWA.rolledalloys.com (24.52.68.146) by SA2PEPF00003F66.mail.protection.outlook.com (10.167.248.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Wed, 8 Jul 2026 23:34:39 +0000

from HQ-NA-EX-01.rolledalloys.com (192.168.51.127) by MI-NA-EX-05.rolledalloys.com (192.168.51.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.55; Wed, 8 Jul 2026 19:34:38 -0400

from MI-NA-EX-05.rolledalloys.com (192.168.51.91) by HQ-NA-EX-01.rolledalloys.com (192.168.51.127) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.55; Wed, 8 Jul 2026 19:34:37 -0400

from BRNB42200D509AA (192.168.84.10) by MI-NA-EX-05.rolledalloys.com (192.168.51.91) with Microsoft SMTP Server id 15.1.2507.55 via Frontend Transport; Wed, 8 Jul 2026 19:34:32 -0400

Received-Spf

Fail (protection.outlook.com: domain of example.com does not designate 24.52.68.146 as permitted sender) receiver=protection.outlook.com; client-ip=24.52.68.146; helo=OWA.rolledalloys.com;

X-Mailer

E-mail Client

Message-Id

<00000039.577ff234.1.00@BRNB42200D509AA>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification