Overview

overview

3

Static

static

3

invoice-LE...02.pdf

windows10-2004-x64

3

invoice-LE...02.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    eml.eml
  • Size 70KB
  • Sample260722-qfbnasfa98
  • SHA256 d453005f0207cde984a4fec1e43dc837f48d1bde0cd47eaceab2d704bcf93bd6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • eml.eml
    .eml 70KB
  • email-html-2.txt
    .html 6KB
  • email-plain-1.txt
    2KB
  • invoice-LE01-434702.pdf
    .pdf 29KB

eml.eml

  • SHA256 d453005f0207cde984a4fec1e43dc837f48d1bde0cd47eaceab2d704bcf93bd6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 21 Jul 2026 14:32:26 +0000

Subject

Invoice LE01-434702 Coming Due for 28738 Southern New Hampshire University

Content-Type

multipart/mixed; boundary="_004_BY1PR13MB66436623CEF3F82013898297A9C22BY1PR13MB6643namp_"

Received

from SA1PR05MB8358.namprd05.prod.outlook.com (2603:10b6:806:1d1::18) by BY1PR05MB10606.namprd05.prod.outlook.com with HTTPS; Tue, 21 Jul 2026 14:35:36 +0000

from BN0PR03CA0023.namprd03.prod.outlook.com (2603:10b6:408:e6::28) by SA1PR05MB8358.namprd05.prod.outlook.com (2603:10b6:806:1d1::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 14:35:14 +0000

from BN2PEPF000044A6.namprd04.prod.outlook.com (2603:10b6:408:e6:cafe::72) by BN0PR03CA0023.outlook.office365.com (2603:10b6:408:e6::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.10 via Frontend Transport; Tue, 21 Jul 2026 14:35:14 +0000

from mx0b-0038d801.pphosted.com (148.163.137.125) by BN2PEPF000044A6.mail.protection.outlook.com (10.167.243.100) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Tue, 21 Jul 2026 14:35:14 +0000

from pps.filterd (m0172066.ppops.net [127.0.0.1]) by mx0b-0038d801.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LDiLUA979106 for <[email protected]>; Tue, 21 Jul 2026 10:35:13 -0400

from mx0a-001ccd01.pphosted.com (mx0a-001ccd01.pphosted.com [205.220.166.161]) by mx0b-0038d801.pphosted.com (PPS) with ESMTPS id 4fhujussqq-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 10:32:33 -0400 (EDT)

from pps.filterd (m0250590.ppops.net [127.0.0.1]) by mx0a-001ccd01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LDj2JS3449293; Tue, 21 Jul 2026 10:32:31 -0400

from mw6pr02cu001.outbound.protection.outlook.com (mail-westus2azon11022088.outbound.protection.outlook.com [52.101.48.88]) by mx0a-001ccd01.pphosted.com (PPS) with ESMTPS id 4fhfjbv4yd-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 10:32:31 -0400 (EDT)

from BY1PR13MB6643.namprd13.prod.outlook.com (2603:10b6:a03:4b3::22) by BY5PR13MB4487.namprd13.prod.outlook.com (2603:10b6:a03:1d4::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 14:32:26 +0000

from BY1PR13MB6643.namprd13.prod.outlook.com ([fe80::1d3e:796f:7be7:f47b]) by BY1PR13MB6643.namprd13.prod.outlook.com ([fe80::1d3e:796f:7be7:f47b%6]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 14:32:26 +0000

Received-Spf

Pass (protection.outlook.com: domain of hyland.com designates 205.220.166.161 as permitted sender) receiver=protection.outlook.com; client-ip=205.220.166.161; helo=mx0a-001ccd01.pphosted.com; pr=C

Message-Id

<BY1PR13MB66436623CEF3F82013898297A9C22@BY1PR13MB6643.namprd13.prod.outlook.com>

Extracted URLs

  • file http://[email protected]/

  • file https://tracking.us.nylas.com/l/bf45366f715844ea8fe7ace98538a5b5/0/26cfcf476655a215408d8e20326d6707921341fd2df4acf7421e95b568afdf80?cache_buster=1784644345

  • file https://tracking.us.nylas.com/l/bf45366f715844ea8fe7ace98538a5b5/0/26cfcf476655a215408d8e20326d6707921341fd2df4acf7421e95b568afdf80?cache_buster=1784644345__;!!BeImMA!8cEBVa1puBEoTxFJsr5-t-g1TxlEgD8p74OKHFHS26kek5xnX3F1bIagXwQPs2cuEgctcACwEetc81xbQ-tm0uk951rEmA$

  • file https://tracking.us.nylas.com/l/bf45366f715844ea8fe7ace98538a5b5/1/bce08a9ffacd3506e8ee1337de18a651f2b46ecb7dd612e512612a48a11cdbb1?cache_buster=1784644345

  • file https://tracking.us.nylas.com/l/bf45366f715844ea8fe7ace98538a5b5/1/bce08a9ffacd3506e8ee1337de18a651f2b46ecb7dd612e512612a48a11cdbb1?cache_buster=1784644345__;!!BeImMA!8cEBVa1puBEoTxFJsr5-t-g1TxlEgD8p74OKHFHS26kek5xnX3F1bIagXwQPs2cuEgctcACwEetc81xbQ-tm0ukfzbmPdg$

  • file https://urldefense.com/v3/__