Overview

overview

3

Static

static

3

NEWSTATE_Q2.2026.xlsx

windows10-2004-x64

1

NEWSTATE_Q2.2026.xlsx

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    4fcec69b-3ed4-50eb-62b8-2bf9076c7ed0.eml
  • Size 100KB
  • Sample260803-ck71eaan4w
  • SHA256 72dbdc4d4c984580fde3647d58f07bf62b5d87b0a33598f4f28476913cafe9ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
qrlink

Malware Config

Signatures

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

    qrlink

File Explorer

  • 4fcec69b-3ed4-50eb-62b8-2bf9076c7ed0.eml
    .eml 100KB
  • NEWSTATE_Q2.2026.xlsx
    .xlsx 38KB
  • email-html-2.txt
    .html 13KB
  • email-plain-1.txt
    2KB
  • image001.png
    .png 10KB

4fcec69b-3ed4-50eb-62b8-2bf9076c7ed0.eml

  • SHA256 72dbdc4d4c984580fde3647d58f07bf62b5d87b0a33598f4f28476913cafe9ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected

Email Headers

Return-Path

[email protected]

Date

Fri, 31 Jul 2026 06:38:22 +0000

Subject

Commission Sharing - Q3 & Q4 -2025 and Q1 & Q2 - 2026

Content-Type

multipart/mixed; boundary="_006_SEYPR03MB7477B46E8E3CCBE398969C7BEDC82SEYPR03MB7477apcp_"

Received

from TY4PR01CA0062.jpnprd01.prod.outlook.com (2603:1096:405:370::14) by JH0PR02MB7984.apcprd02.prod.outlook.com (2603:1096:990:9f::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.15; Fri, 31 Jul 2026 06:38:26 +0000

from TY2PEPF0000AB86.apcprd03.prod.outlook.com (2603:1096:405:370:cafe::7a) by TY4PR01CA0062.outlook.office365.com (2603:1096:405:370::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.15 via Frontend Transport; Fri, 31 Jul 2026 06:38:26 +0000

from SEYPR02CU001.outbound.protection.outlook.com (2a01:111:f403:c40f::6) by TY2PEPF0000AB86.mail.protection.outlook.com (2603:1096:408::d0a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Fri, 31 Jul 2026 06:38:26 +0000

from SEYPR03MB7477.apcprd03.prod.outlook.com (2603:1096:101:147::13) by TYZPR03MB7770.apcprd03.prod.outlook.com (2603:1096:400:429::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Fri, 31 Jul 2026 06:38:22 +0000

from SEYPR03MB7477.apcprd03.prod.outlook.com ([fe80::77dd:9c0:e600:d307]) by SEYPR03MB7477.apcprd03.prod.outlook.com ([fe80::77dd:9c0:e600:d307%3]) with mapi id 15.21.0245.012; Fri, 31 Jul 2026 06:38:22 +0000

Received-Spf

Pass (protection.outlook.com: domain of mrc.co.th designates 2a01:111:f403:c40f::6 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c40f::6; helo=SEYPR02CU001.outbound.protection.outlook.com; pr=C

Message-Id

<SEYPR03MB7477B46E8E3CCBE398969C7BEDC82@SEYPR03MB7477.apcprd03.prod.outlook.com>

Extracted URLs

  • file http://www.mrc.co.th

  • file http://www.mrc.co.th/

  • file https://mrc.co.th/PrivacyNotice.html