request_190098_1785837337218.zip
- SHA256 7dbc07db25c96b14610ad97186996ef2574a24331b64c417facbe1dba66c2ee9
Overview
overview
4Static
static
4request_19...18.zip
windows10-2004-x64
1request_19...18.zip
windows11-ltsc_2024-x64
1.eml
windows10-2004-x64
1.eml
windows11-ltsc_2024-x64
1Financial ...v2.pdf
windows10-2004-x64
3Financial ...v2.pdf
windows11-ltsc_2024-x64
3Outlook-2ohm5u0j.jpg
windows10-2004-x64
1Outlook-2ohm5u0j.jpg
windows11-ltsc_2024-x64
1Outlook-vb4f2s0o.png
windows10-2004-x64
1Outlook-vb4f2s0o.png
windows11-ltsc_2024-x64
1email-html-2.html
windows10-2004-x64
3email-html-2.html
windows11-ltsc_2024-x64
3email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1Financial ...v2.pdf
windows10-2004-x64
3Financial ...v2.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
request_190098_1785837337218.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
request_190098_1785837337218.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
.eml
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral4
Sample
.eml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
Behavioral task
behavioral5
Sample
Financial planning basics - Keolis MHI v2.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral6
Sample
Financial planning basics - Keolis MHI v2.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
Behavioral task
behavioral7
Sample
Outlook-2ohm5u0j.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
Outlook-2ohm5u0j.jpg
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral9
Sample
Outlook-vb4f2s0o.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral10
Sample
Outlook-vb4f2s0o.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral11
Sample
email-html-2.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral12
Sample
email-html-2.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral13
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Financial planning basics - Keolis MHI v2.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
General
- Target request_190098_1785837337218.zip
- Size 5.1MB
- Sample260804-ly8njaxcmf
- SHA256 7dbc07db25c96b14610ad97186996ef2574a24331b64c417facbe1dba66c2ee9
- MD5 6f6e1b67e5f822989b9dc2046be557a9
- SHA1 6f428cfca10f7f6f3289bfdd0fbdfa420109465c
- SHA512 3081fde8f06f5ac4663aa8630e877be077806c5ded886d1e2479f7f4e435ef8b09cc921f2a8c9b1e03a5a2aed111e2b5fae2448855755f8cb6cd502839121ef4
- SSDEEP 98304:woNGU/KQ7WaxZhGIUHUh63sm9xxGVOAEr7F4smV0uI/bMnQooxa:w7U/KQ7vLo5HTg0Dr7ismVobaQooM
- TLSH T17C3633C2FB32ED48B295BC54522EBE565BE4FC75DAECC4B5402C022426DC0A15CBDDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- HTTP links in PDF interactive object 2 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule static1/unpack002/Financial planning basics - Keolis MHI v2.pdf pdf_with_link_action static1/unpack001/Financial planning basics - Keolis MHI v2.pdf pdf_with_link_action
File Explorer
-
request_190098_1785837337218.zip.zip 5.1MB
-
.eml.eml 3.7MB
-
Financial planning basics - Keolis MHI v2.pdf.pdf 2.6MB
-
Outlook-2ohm5u0j.jpg 21KB
-
Outlook-vb4f2s0o.png.png 14KB
-
email-html-2.txt.html 19KB
-
email-plain-1.txt2KB
-
Financial planning basics - Keolis MHI v2.pdf.pdf 2.6MB
.eml
- SHA256 f91dc1da516cdbbcafedf39d470c9b4131e60c18922e9c66c35da43ee572ec39
- MD5 dcd125306e7b453380b1d6bb95d7fe20
- SHA1 965ccf0b536e4948eda68ab81ea52ebf4ac58758
- SHA512 060bc8d61a1f8fa03996d74ef02eb7f1eed660a8475d74a54633fd00487d629d9e732bf696430fc721ade6a86cc5092c99797668fc17229da190ac694a38a19e
- SSDEEP 49152:tfQ2oeve2JA9fXOQVRkzpDGYexUP//VRqaNAsNhC:O
- TLSH T181060133EE760E9A070146BF570BB6C47C3E7BAB0A9E85F731A68227F07C562C294554
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
In-Reply-To
PAWPR02MB9949DA3AB1620CD970E14F62F3D52@PAWPR02MB9949.eurprd02.prod.outlook.com
Return-Path
Date
Mon, 3 Aug 2026 13:57:56 +0000
Subject
[External] Zurich Presentation last Wednesday for Financial Literacy Session (for your reference)
Content-Type
multipart/mixed; boundary="_007_PAWPR02MB9949F6F31F00C4145E7744D7F3D52PAWPR02MB9949eurp_"
Received
from DX1P273MB1499.AREP273.PROD.OUTLOOK.COM (::1) by DX6P273MB2588.AREP273.PROD.OUTLOOK.COM with HTTPS; Mon, 3 Aug 2026 13:59:20 +0000
from DX0P273CA0044.AREP273.PROD.OUTLOOK.COM (2603:1086:300:58::17) by DX1P273MB1499.AREP273.PROD.OUTLOOK.COM (2603:1086:300:85::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.17; Mon, 3 Aug 2026 13:58:08 +0000
from DX1PEPF000003F1.AREP273.PROD.OUTLOOK.COM (2603:1086:300:58:cafe::8d) by DX0P273CA0044.outlook.office365.com (2603:1086:300:58::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.17 via Frontend Transport; Mon, 3 Aug 2026 13:58:08 +0000
from mx08-002e5d02.pphosted.com (185.183.28.79) by DX1PEPF000003F1.mail.protection.outlook.com (10.167.240.54) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Mon, 3 Aug 2026 13:58:06 +0000
from pps.filterd (m0128646.ppops.net [127.0.0.1]) by mx08-002e5d02.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 673DRgD82607036 for <[email protected]>; Mon, 3 Aug 2026 15:58:04 +0200
from du2pr03cu002.outbound.protection.outlook.com (mail-northeuropeazon11011025.outbound.protection.outlook.com [52.101.65.25]) by mx08-002e5d02.pphosted.com (PPS) with ESMTPS id 4ftup908qu-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for <[email protected]>; Mon, 03 Aug 2026 15:58:02 +0200 (MEST)
from PAWPR02MB9949.eurprd02.prod.outlook.com (2603:10a6:102:2e0::9) by AS8PR02MB8421.eurprd02.prod.outlook.com (2603:10a6:20b:538::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Mon, 3 Aug 2026 13:57:56 +0000
from PAWPR02MB9949.eurprd02.prod.outlook.com ([fe80::76b2:bcbf:5e85:4204]) by PAWPR02MB9949.eurprd02.prod.outlook.com ([fe80::76b2:bcbf:5e85:4204%4]) with mapi id 15.21.0270.016; Mon, 3 Aug 2026 13:57:56 +0000
Received-Spf
Pass (protection.outlook.com: domain of zurich.com designates 185.183.28.79 as permitted sender) receiver=protection.outlook.com; client-ip=185.183.28.79; helo=mx08-002e5d02.pphosted.com; pr=C
Message-Id
<PAWPR02MB9949F6F31F00C4145E7744D7F3D52@PAWPR02MB9949.eurprd02.prod.outlook.com>
Extracted URLs
-
file http://www.zurich.ae/
-
file http://www.zurich.lu/en/services/legal.
-
file http://www.zurichinternational.com/en/zurich-international-life/about-us/legal-entities
-
file https://aka.ms/LearnAboutSenderIdentification
-
file https://ithelpdesk.dubaimetro.ae/
-
file https://urldefense.com/v3/__
-
file https://urldefense.com/v3/__https:/www.zurich.ae/customer-claims-report-2025__;!!FVajH6CFHhmYMuQ!4as71j5-f0aoyVEp9yzO0Ilxhi21LB-H8K18kJT8PWEAM_pm4hIqS6_7_aEgOzASEhYHOZQUFL-6DlMsDft6uE1qJWaEbL-GnyhRf_0MZOrB_hA$
Financial planning basics - Keolis MHI v2.pdf
- SHA256 3ac0d77f94ebc5c3ae04dcec894ff9f299e4bf67c269993f8d9da4d120ab1cc4
- MD5 d6d8e1b3a00ad9a0015d7c3b02161491
- SHA1 592170dc593ca90c7c8cac522af4ec2eb5eb58ce
- SHA512 65ee219f49363301c9476752d1022ec15a636a6a2ecc886ab370f8b3c822b570eaca060b212c474b5f9c2d078e76d48e108055afc2da6f89b32037e14bdec51f
- SSDEEP 49152:wTFEcwfHLyG7puvy1M7L/V3q+LdJ1I0gc+HBBSVmUOlFpruYHK6Zuss:wecp+eFV3qaT5+px9aGls
- TLSH T125D5F113884D5BCED12543F47F072D592F0D762AE2C666EE112BCB876620F3A488F56E
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file https://edge.sitecorecloud.io/zurichinsurf8c0-zwpshared-prod-d824/media/project/zurich-headless/middle-east/documents/adviser-suite/education-savings-plan/education-cost-sources-1024.pdf
-
file https://www.zurich.ae/education2023
Outlook-2ohm5u0j
- SHA256 ee5dd818542c0de049a4a436d834c3815b5224ff432c681a6538ddf849fabbfa
- MD5 af619dfd6a77d7243d547997f0d603c2
- SHA1 49a9925a878136ec6eb31ecce7d018eaacc07014
- SHA512 8244dfb92113ff2144ea73c52a736f17581002d039bff55cf09ed58728964568eaa030d636222a5577c482ec549f24515374bb8c3caa01e526ae86ca9c882a7d
- SSDEEP 384:04oqoscJE5AWVCjOdvFjOnJ3Kg015O+Z+yUDlSEMgGBU7ViU2K84Owx:0Tsm4AtjG5OnJ6gQM+ZfTNBSViL4Oi
- TLSH T1CCA2D01D79832341DB269934A8CA9761E9FB6704E4948E0F747FB6125FC46C046BE1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Outlook-vb4f2s0o.png
- SHA256 9456a003a3f7862dd70e75a9430a3054c8814f6b020a3bc6c4343f645c2a091f
- MD5 d82c6106cf63c68f0aa41c860a27f360
- SHA1 6c9e2fc3abbb7286ebe7fbd0609c84969a39253a
- SHA512 1c9add93ed8631b9807037a769d8dbf542aafeea954270797d70a30a19c03ab8df2055787a7e68bf3dcc0e7bddcb1b11e41d50e3f4890f4ee1d629e10c8eadcb
- SSDEEP 192:08kBopRcWUtGwHDxM04JfNwhFVrNzoV7b0PDmPOL2g7eJDeqWjhsnAyo+3PZf4R8:0rBobbrwHDxs7whbmGDmGreZemAHmmG
- TLSH T17562D04BC2C92A107E8A3FB058338A7849141F1A685FF6DC953B38CD5E17203FA9D268
- MD5 SHA1 SHA512 SSDEEP TLSH
email-html-2.txt
- SHA256 56d6aea5b51579b68a1fa9c08c23f6d2e45a529ae9f77c17fe9bea7cd4119551
- MD5 9efdace598f2abdca0edee5c3a9cd55c
- SHA1 213487d3ace5fe6a985b266d2058a6082315b478
- SHA512 d12b271bbea6ccec316e6af8df457f17083b873ca85d821dfbbc9014884795861a06893199fbaaeee1b96ff40ea0ee7aa4e807f71e8780d2027a105b57d50e42
- SSDEEP 192:78x2PUx2Sx2Bx23Bx2QGx22OBx27I73JZ+7I0w5Xy89Wa+SlX9zdvkuI6pGE:g7BmOTcnOTmIXn9fhlX9zdT
- TLSH T14D92D723F3C01915CE9B4964A943737D7F3981C69F264D7869DA7B3E0B8DCE292D1288
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 3fb4ab9cf5a055c7d476fe0185933802616c2f8469044f46884456406f65367e
- MD5 84fbb8486c339191821062addab3f880
- SHA1 82fcae997ed116813725ba668de7934f99ab6867
- SHA512 453562111b8b93eae03400993f5bd04cf0880bc465e9e94283b25db00003a82d85f3f702fd36cb11909945b5f392cbfe2926b7732f816846b6868f7068095854
- TLSH T10C41AA7BB6CE122A4683C1917A1A93C9D27E107463555188B85483EA03C6F7DF77DE8C
- MD5 SHA1 SHA512 TLSH
Financial planning basics - Keolis MHI v2.pdf
- SHA256 3ac0d77f94ebc5c3ae04dcec894ff9f299e4bf67c269993f8d9da4d120ab1cc4
- MD5 d6d8e1b3a00ad9a0015d7c3b02161491
- SHA1 592170dc593ca90c7c8cac522af4ec2eb5eb58ce
- SHA512 65ee219f49363301c9476752d1022ec15a636a6a2ecc886ab370f8b3c822b570eaca060b212c474b5f9c2d078e76d48e108055afc2da6f89b32037e14bdec51f
- SSDEEP 49152:wTFEcwfHLyG7puvy1M7L/V3q+LdJ1I0gc+HBBSVmUOlFpruYHK6Zuss:wecp+eFV3qaT5+px9aGls
- TLSH T125D5F113884D5BCED12543F47F072D592F0D762AE2C666EE112BCB876620F3A488F56E
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file https://edge.sitecorecloud.io/zurichinsurf8c0-zwpshared-prod-d824/media/project/zurich-headless/middle-east/documents/adviser-suite/education-savings-plan/education-cost-sources-1024.pdf
-
file https://www.zurich.ae/education2023