Overview

overview

4

Static

static

4

attachment-3.pdf

windows10-2004-x64

3

attachment-3.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    31cd9893-f59c-adb2-9046-023dfe61842f.eml
  • Size 98KB
  • Sample260727-lt2dnaac79
  • SHA256 10cf346c48991f8e88380bc37ad72b6cba19a1c1e6d6ab226ff69eee65c7ff0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
pdflinkqr

Malware Config

Signatures

  • PDF has QR code that contains a HTTP URL

    PDFs with URL QR codes are often used for phishing

    pdfqr
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • 31cd9893-f59c-adb2-9046-023dfe61842f.eml
    .eml 98KB
  • attachment-3.pdf
    .pdf 62KB
  • email-html-2.txt
    .html 586B
  • email-plain-1.txt
    116B

31cd9893-f59c-adb2-9046-023dfe61842f.eml

  • SHA256 10cf346c48991f8e88380bc37ad72b6cba19a1c1e6d6ab226ff69eee65c7ff0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
G<mA9jQiG(4#s<v%66lN

Email Headers

Return-Path

[email protected]

Date

Mon, 27 Jul 2026 01:48:27 -0700 (PDT)

Subject

Content-Type

multipart/mixed; boundary="===============93321032485047931416=="

Received

from SI2PR02CA0036.apcprd02.prod.outlook.com (2603:1096:4:195::15) by KL1PR06MB6592.apcprd06.prod.outlook.com (2603:1096:820:f1::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul 2026 08:48:30 +0000

from SG2PEPF000B66CF.apcprd03.prod.outlook.com (2603:1096:4:195:cafe::82) by SI2PR02CA0036.outlook.office365.com (2603:1096:4:195::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Mon, 27 Jul 2026 08:48:29 +0000

from mail-pl1-x664.google.com (2607:f8b0:4864:20::664) by SG2PEPF000B66CF.mail.protection.outlook.com (2603:1096:f:fff6::5a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Mon, 27 Jul 2026 08:48:29 +0000

by mail-pl1-x664.google.com with SMTP id d9443c01a7336-2cc7e86e7aeso25643505ad.2 for <[email protected]>; Mon, 27 Jul 2026 01:48:29 -0700 (PDT)

from [91.124.130.96] ([91.124.130.96]) by smtp-relay.gmail.com with ESMTP id d9443c01a7336-2cfde5b54desm6851825ad.16.2026.07.27.01.48.27 for <[email protected]>; Mon, 27 Jul 2026 01:48:27 -0700 (PDT)

X-Received

by 2002:a17:903:2d0:b0:2cf:7ffb:82aa with SMTP id d9443c01a7336-2cfde899299mr66763205ad.45.1785142107499; Mon, 27 Jul 2026 01:48:27 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of ecswellness.com designates 2607:f8b0:4864:20::664 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::664; helo=mail-pl1-x664.google.com; pr=C

Message-Id

<[email protected]>