General

  • Target
    17-12-25 Invitation- header data
  • Size 9.3MB
  • Sample260803-ddhydabb98
  • SHA256 3df3044758d07716d81ddd30d69ac77e749f27e13f60cd1693302555ffebf320
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

File Explorer

  • 17-12-25 Invitation- header data
    .eml 9.3MB
  • Evidence bundle.pdf
    .pdf 6.5MB
  • WhatsApp Image 2025-12-18 at 1.54.28 PM.jpeg
    .jpg 223KB
  • email-html-2.txt
    .html 44KB
  • email-plain-1.txt
    19KB

17-12-25 Invitation- header data

  • SHA256 3df3044758d07716d81ddd30d69ac77e749f27e13f60cd1693302555ffebf320
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Delivered-To

[email protected]

Return-Path

<[email protected]>

Date

Thu, 18 Dec 2025 14:40:17 +1300

Subject

RE: Invitation to disciplinary hearing - Alleged Serious Misconduct

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0704_01DC702C.3B91E000"

Received

by 2002:a05:7208:3c9:b0:f3:5e6b:21c1 with SMTP id m9csp126473rbb; Wed, 17 Dec 2025 17:41:27 -0800 (PST)

from spx07.mail.isx.net.nz (spx07.mail.isx.net.nz. [111.65.230.114]) by mx.google.com with ESMTPS id 41be03b00d2f7-c1d301e6615si1519956a12.111.2025.12.17.17.40.43 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Dec 2025 17:41:24 -0800 (PST)

from omr03.mail.isx.net.nz ([111.65.230.130]) by spx07.mail.isx.net.nz with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <[email protected]>) id 1vW308-00GVbE-Hf; Thu, 18 Dec 2025 14:40:42 +1300

from DESKTOPGCO0UTR (unknown [27.252.166.124]) (Authenticated sender: [email protected]) by omr03.mail.isx.net.nz (Postfix) with ESMTPA id 249CE41130; Thu, 18 Dec 2025 14:40:18 +1300 (NZDT)

X-Received

by 2002:a05:6a20:e290:b0:341:c255:7148 with SMTP id adf61e73a8af0-369ae0ac096mr21833862637.28.1766022085155; Wed, 17 Dec 2025 17:41:25 -0800 (PST)

Received-Spf

pass (google.com: domain of [email protected] designates 111.65.230.114 as permitted sender) client-ip=111.65.230.114;

X-Mailer

Microsoft Outlook 16.0

Message-Id

<[email protected]>

Extracted URLs

  • file https://goldencontracting.co.nz/