General

  • Target
    Message.eml
  • Size 440KB
  • Sample260723-qjejcsbb43
  • SHA256 f6c0203c8de2eae73f52b74dacf94ee7954d37b894a0d8a1ab2480b3fcdefae5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • Message.eml
    .eml 440KB
  • AIR CP_100212109_CP_20260722_Enforcement (1).pdf
    .pdf 295KB
  • email-html-2.txt
    .html 5KB
  • email-plain-1.txt
    595B
  • image003.png
    .png 8KB

Message.eml

  • SHA256 f6c0203c8de2eae73f52b74dacf94ee7954d37b894a0d8a1ab2480b3fcdefae5
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

PARP264MB5103E7716E450206C3E4DFFA90C12@PARP264MB5103.FRAP264.PROD.OUTLOOK.COM

Return-Path

[email protected]

Date

Wed, 22 Jul 2026 21:04:19 +0000

Subject

Request for Updated W-9

Content-Type

multipart/mixed; boundary="_006_MRZP264MB1605536639E83AF0721C6900CBC12MRZP264MB1605FRAP_"

Received

from SJ2P221CA0011.NAMP221.PROD.OUTLOOK.COM (2603:10b6:a03:5db::7) by IA5PR13MB984487.namprd13.prod.outlook.com (2603:10b6:208:606::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Wed, 22 Jul 2026 21:04:26 +0000

from CO1PEPF000075F1.namprd03.prod.outlook.com (2603:10b6:a03:5db:cafe::a2) by SJ2P221CA0011.outlook.office365.com (2603:10b6:a03:5db::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.10 via Frontend Transport; Wed, 22 Jul 2026 21:04:26 +0000

from PR0P264CU014.outbound.protection.outlook.com (40.107.161.37) by CO1PEPF000075F1.mail.protection.outlook.com (10.167.249.40) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Wed, 22 Jul 2026 21:04:24 +0000

from MRZP264MB1605.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:16::14) by PR0P264MB2421.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1e0::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Wed, 22 Jul 2026 21:04:19 +0000

from MRZP264MB1605.FRAP264.PROD.OUTLOOK.COM ([fe80::ca85:401c:462b:10b9]) by MRZP264MB1605.FRAP264.PROD.OUTLOOK.COM ([fe80::ca85:401c:462b:10b9%5]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026 21:04:19 +0000

Received-Spf

Pass (protection.outlook.com: domain of external.totalenergies.com designates 40.107.161.37 as permitted sender) receiver=protection.outlook.com; client-ip=40.107.161.37; helo=PR0P264CU014.outbound.protection.outlook.com; pr=C

Message-Id

<MRZP264MB1605536639E83AF0721C6900CBC12@MRZP264MB1605.FRAP264.PROD.OUTLOOK.COM>