Received from Carrier[.]EML

Sharing

Copy URL Twitter E-mail

General

Target
Received from Carrier.EML
Size 5.7MB
Sample260722-y7g86athle
SHA256 1cf4073548c93c13859fd8e749cef93954cb00c3474461306176019e78193837
MD5 cc6d1509b24172c14ff84f39e0c0eb4e
SHA1 490cd914c51be6a9b361229daf0986c3604bc280
SHA512 3acf9398a600db80b1e81db622db04b94118321115a6de7f85065938385a4e3bfbdb0243ac0e636caf16db7eb9f1b4aa534cf7099c43190ecff287a372cfb058
SSDEEP 49152:m61B/YqIOzif8ioAU06HXHW5nMyX2HJREmXWfYdAR5VxtzdWsDFgFBQo:T
TLSH
T10556F13FBDD2468D6728937F5B37AEA3DC679E1B2ECB0883792C414751AC762481680D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/725_RenewalQuote_AndersonLivingTrust_A48383_07182025_CIBAI_2025-2027.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link
One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
pdf

File Explorer

Received from Carrier.EML

.eml 5.7MB
725_RenewalQuote_AndersonLivingTrust_A48383_07182025_CIBAI_2025-2027.pdf

.pdf 4.1MB
email-html-1.txt

.html 23KB
image001.png

.png 9KB
image002.png

.png 845B

Received from Carrier.EML

SHA256 1cf4073548c93c13859fd8e749cef93954cb00c3474461306176019e78193837
MD5 cc6d1509b24172c14ff84f39e0c0eb4e
SHA1 490cd914c51be6a9b361229daf0986c3604bc280
SHA512 3acf9398a600db80b1e81db622db04b94118321115a6de7f85065938385a4e3bfbdb0243ac0e636caf16db7eb9f1b4aa534cf7099c43190ecff287a372cfb058
SSDEEP 49152:m61B/YqIOzif8ioAU06HXHW5nMyX2HJREmXWfYdAR5VxtzdWsDFgFBQo:T
TLSH
T10556F13FBDD2468D6728937F5B37AEA3DC679E1B2ECB0883792C414751AC762481680D
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

[email protected]

In-Reply-To

b57c0a616c554dabab2c2b0580872392@PH0PR18MB4522.namprd18.prod.outlook.com

Date

Fri, 18 Jul 2025 18:36:34 +0000

Subject

ANDEMYRO 2025 Renewal Quote | Anderson Living Trust | A48383

Content-Type

multipart/mixed; boundary="_005_MW2PR18MB2089EF19BA1A493E22E723A0FA50AMW2PR18MB2089namp_"

Received

from SJ0PR18MB4480.namprd18.prod.outlook.com (::1) by IA0PPFBB9A48050.namprd18.prod.outlook.com with HTTPS; Fri, 18 Jul 2025 18:36:39 +0000

from MW2PR18MB2089.namprd18.prod.outlook.com (2603:10b6:907:10::11) by SJ0PR18MB4480.namprd18.prod.outlook.com (2603:10b6:a03:3ae::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8922.39; Fri, 18 Jul 2025 18:36:34 +0000

from MW2PR18MB2089.namprd18.prod.outlook.com ([fe80::ac71:2172:ae07:a6b7]) by MW2PR18MB2089.namprd18.prod.outlook.com ([fe80::ac71:2172:ae07:a6b7%7]) with mapi id 15.20.8901.023; Fri, 18 Jul 2025 18:36:34 +0000

Message-Id

<MW2PR18MB2089EF19BA1A493E22E723A0FA50A@MW2PR18MB2089.namprd18.prod.outlook.com>

Extracted URLs

file https://report.mimecastcybergraph.com/?magiclink=https%3A%2F%2Fapi.services.mimecast.com%2Foauth2%2Fauthorize%3Fresponse_type%3Dcode%26client_id%3Do20nRkVXf7VUVnANkXhoOwGytEwGN0YAlyeDJn7oBTGNl2kN%26state%3DeyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.StXlPRXKZGYjdVpBL9ZfA2ANf0CMqaFFt78jS1Qd4EyFXjMdM8TPvpGm1b9Ds6hcBSBZuzO1_ZrbWLEja3q9TxVTMis4q_o1G_fLQkE2weM9I38xCL_fjPI9WN5qPrZS-tW6gwGEKLXDSC6LOJCt-4ANdzNI-Jw8yHLtxBQKVmBDa4dxpzfmh5FlJ0YoAsdkDvhvzD9S4Gfsf_gZ2eYgF4XHffOoKdNZiSMQutu23YJwk-lHQVyLXGKPLT8PU9RTgVnaBDmtepmU1QQucpXP16RGtT0NTB_4TGEk8XlzUDcmwgWOMAmMK-GYljrfMIg2xc3I97IBq0GTUHAyK9l7YA.sjPkD6QJ-w5XmJMK.zl_egkyPXt6t8GxRJBMvIPQuDrZIsDb-oQf-HNUkrXVOskduwWMcVmkajISZGctljkOtHAUZUXpjkL5hFOqwQXhU-e7alotTtz_t4GjJ-FDHyg-Au0lfQFEJot8R4Z9n9Af0SUmmhpInS461wZ_WQwQDGKv0SgWXRQrVcBuci7MUubbk6_mI8QC1XoyaTd3zX4REQOJjGAlpwPv1QmhV0k4XmHFk3EcxpgqI4YrniBFJWGSwER1Fcwqql3YcP9c3IuQaRqH-NhUIRUHFH7eTvV-xnrLevZ74lmXa-dLrf8F9MSODRCSqVA_bdDNmEhx6_S3J5ocPHcfb3YL_uIQkAM73Xp9V26Jj51XNMp9QAIOFwiP3ixv75KtqCz9a-F55I9EWhDpxDVbCX6cps6lhg9A3jlDc95jDK6Zfq-2xulfL2dYdrMq5nfwew9qXkaNLKm4SSjW65tDcEBnM-y2_g6WwH38mUk3WDpB6q7chOuRSA4uTDNGY6-RbQmHWotgzsI3JMInD4B3oDE2ZzThU7cs6gpy1gZmry2FFonEs6tKvDVPSewmdFxLWgIyiwH-9q-imwMPmNF40vebjvKm2pMhpQXMFZ3qxWg9oIILthG2kRIRTi6Dq724H62xGLVGNE6yaAmSUx3MTD_5dkYewDbFICWPd7fsDE6f-539zjFyEYwawNXUOXm4VJQAOl-XCfYZnWetB7FDlhWAJeXt0bTabWeKFr0U7_nYb8UOgSxRiq07ovN2QmMFaY6j6LyyQ_WceVEseoEY6VAetXkYST1_xzjSUmYOVNAjF5eWp_c9JdOky_GaNxEV3V7kDbGGhiJN6BUb7Fih9fN1X7xeZbL8.Qp0We0moWJZtFDJa-ZqOgw%26redirect_uri%3Dhttps%3A%2F%2Freport.mimecastcybergraph.com%2Fcallback
file https://url.us.m.mimecastprotect.com/s/2fdzCmZPrNsPMgPviBiAiR5DVm?domain=cibaservices.com/
file https://url.us.m.mimecastprotect.com/s/bvO_CkRPpXIXwKXgS2fxiGliDX?domain=linkedin.com/
file https://www.propelinsurance.com/

725_RenewalQuote_AndersonLivingTrust_A48383_07182025_CIBAI_2025-2027.pdf

SHA256 c617f44207878433a58d48dbad4c6dc3779e4367ba1dcfba49019c6e0ffce484
MD5 44e5312483b1a06268fd749f7ca0ddbb
SHA1 1109165f5cad1f1f0456657ed9f319201430f29c
SHA512 f0add542b928b314b8fe87517afcf82666ab920b8bd67c8369c3b77b3db16ddf0d1f80e87146b2d2daea74c648d965a3d899078caee3f245673272284c2ef240
SSDEEP 98304:DicK0TePcVcz/FaosnVOyO5AIjsQ5qfDPqdZ:DicK0TePcVcz1YOyO5AIjsQ5gD6Z
TLSH
T1CE16D010E42B9C5EEC8797F9992B393C4A0DB227B6CA7DC015E54F50B244E5C8BD28F6
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link

Extracted URLs

file http://cca.hawaii.gov/ins/surplus-lines-tax/
file http://cibaservices.com
file http://disb.dc.gov/page/surplus-line-information
file http://insurance.maryland.gov/Producer/Pages/SurplusLinesBrokers.aspx
file http://oci.wi.gov/pub_list/pi-026.htm
file http://www.ipoausa.com/wp-content/uploads/2013/08/WA-Affidavit.pdf
file http://www.mass.gov/ocabr/docs/doi/producer/surpaffidavit.pdf
file http://www.michigan.gov/difs/0,5269,7-303-22535_26607---,00.html
file http://www.mnsla.com/
file http://www.nsla.org/
file http://www.oregonsla.org/resources/forms
file http://www.slacal.com/docs/default-source/general-content-documents/Filing-Forms/sl2-printable.pdf?sfvrsn=2
file http://www.state.nj.us/dobi/division_insurance/pdfs/slps6cert1.pdf
file http://www.wvinsurance.gov/LinkClick.aspx?fileticket=rQMRNCsk-MM%3d&tabid=369&portalid=4&mid=720
file https://csimt.gov/wp-content/uploads/2022/10/SurplusLines_Submission_Electronic_ext-7-2019.pdf
file https://dbr.ri.gov/documents/news/insurance/InsuranceBulletin2018-9.pdf
file https://delawaregov-search.clients.us.funnelback.com/s/redirect?collection=delaware-meta&url=https%3A%2F%2Finsurance.delaware.gov%2Fwp-content%2Fuploads%2Fsites%2F15%2F2017%2F12%2FSL-1923-DiligentSearchForm-2017.xlsm&auth=sbEG7pDRGq49qdn6NDrxUw&profile=insurance&rank=2&query=SL-1923
file https://dfr.vermont.gov/industry/insurance/producer-and-individual-licensing/apply-and-renew-your-license/surplus-lines
file https://dlr.sd.gov/insurance/surplus_lines.aspx
file https://doi.colorado.gov/sites/doi/files/documents/Colorado.DE_.Form_.2025.04.pdf
file https://doi.nebraska.gov/producers/surplus-lines-information
file https://drive.google.com/file/d/13S-D8XXMNWJ0LVYR7jqjtXsLV1YxC4cb/view
file https://drive.google.com/file/d/13TdGmySvqtCuzYuKZxJIJSxT7IuITl_3/view
file https://iid.iowa.gov/surplus
file https://insurance.arkansas.gov/uploads/pages/formaidacsl-3.pdf
file https://insurance.ks.gov/desktop/files/SLTax/SL-Statement-Insured.pdf
file https://insurance.ky.gov/ppc/new_default.aspx?divid=24
file https://insurance.ohio.gov/static/Forms/Documents/INS4024.pdf
file https://oci.georgia.gov/regulatory-filings/premium-tax/non-admitted-insurance
file https://portal.ct.gov/cid/licensing/licensing-resource-library/faqs---surplus-lines-brokers?language=en_US
file https://www.commerce.alaska.gov/web/portals/11/pub/SurplusLines/08-1236.pdf
file https://www.elany.org/f.aspx?f=44
file https://www.elany.org/f.aspx?f=85
file https://www.fslso.com/docs/default-source/businessforms/statement-of-diligent-effort-form.pdf?sfvrsn=39d41b35_22
file https://www.idahosurplusline.org/
file https://www.in.gov/idoi/
file https://www.insurance.nd.gov/producers/other-licenses/surplus-lines
file https://www.ldi.la.gov/industry/taxes-and-assessments/surplus-lines-premium-tax
file https://www.maine.gov/pfr/insurance/sites/maine.gov.pfr.insurance/files/inline-files/457.pdf
file https://www.mid.ms.gov/legal/bulletins/20173bul.pdf
file https://www.ncsla.com/tax/tax-filing/compliance
file https://www.nh.gov/insurance/companies/surpluslines/index.htm
file https://www.oid.ok.gov/wp-content/uploads/2019/11/100615_SL-3c-Surplus-Lines-Insurance-Broker-Form-11-1-2015.pdf
file https://www.one80intermediaries.com/wp-content/uploads/2020/04/New-Mexico-tax-form.pdf
file https://www.pasla.org/Documents/1609-PR-01-01-2013.pdf
file https://www.riskinnovations.com/wp-content/uploads/2017/01/Diligent-Effort-Form.pdf
file https://www.shellyins.com/uploads/documents/StatementOfDiligentEffortForm_No_Watermark.pdf
file https://www.slacal.com/docs/default-source/general-content-documents/filing-forms/d1-form-rev-01-01-2020ff0000daf5f3605fb3205a7b46ffa6a2.pdf?sfvrsn=50f3606d_4
file https://www.slai.org/
file https://www.sltx.org/
file https://www.tn.gov/commerce/insurance/types-of-insurance-companies/surplus-lines.html
file mailto:[email protected]
file mailto:[email protected]?subject=SLB-9%20Please%20advise%20policy%20number
Show all

Sharing

General

Malware Config

Signatures

File Explorer

Received from Carrier.EML

Email Headers

Extracted URLs

725_RenewalQuote_AndersonLivingTrust_A48383_07182025_CIBAI_2025-2027.pdf

Extracted URLs

email-html-1.txt

image001.png

image002.png