QuarantineMessage (20)[.]zip

QuarantineMessage (20).zip

SHA256 ce7b3160abe3dd18f444788be1a6b1a92a5cf6143ded00cb7fae2e44ab7c7aca
MD5 7788bd0aab8fe02a1b348fec32d55004
SHA1 d791d71889b69c2ef452c4515ba5e9983f089ed3
SHA512 5913927072cf98f46d02f2b6554ef01ecc5e61242ef073ab33d9f89477b92eb8d7ee9d7a56c7a561a529a42b4d915c79e5bb594a6672cdfbd285a97ea1897a19
SSDEEP 12288:lmqHiRiQ7pFOWR2RkuXIK/FK4K8zjzESJMScfYA:gCijF50RhKYj5JMScD
TLSH
T18AA423CD6AF05A95684B1D5E9718DFBFCF38CB0E8C15622DB1EB871AF8E912848DD410
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

faadfc3e-98f5-47df-86e2-08def3d1f837/516f161a-8abd-4522-110b-03cdaa417fc3.eml

SHA256 afaed849201f82ff44fbd01f16a7800e5354eb0b531d24813729c779a97416be
MD5 95ba8bf62c02e966c71e86b05b258e6c
SHA1 3286a199bdef64165d04fdae97a93eaacf68ed15
SHA512 ce8ee427706d3461ac9f1b0a8d7c79ad1a41cbfda0755d333e3816adb8e30881203ac0aa56a80f4aa256a78b6bfd9559fe63a84db2cb47090549b4046b06679a
SSDEEP 12288:ngYWu7cLBkYxj0I9ojKsUTMklWXRYtInRDpbhoQ2gOaY0gF+1QDFH:v7Xgl+/sMkl2YtIFpbhE0cN
TLSH
T1E1D4233CDF0802CF582271F7BD23F649B39E6A8F4C935753622CC6A529CF29A5A53941
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

BYAPR10MB30625D498FC6A962D0FF99D8EED32@BYAPR10MB3062.namprd10.prod.outlook.com

Return-Path

[email protected]

Date

Thu, 6 Aug 2026 15:47:03 +0000

Subject

[EXTERNAL] FW: RFMW - 0806JB - RFQ

Content-Type

multipart/mixed; boundary="_006_CH3PR14MB620298F502362572C2160918A1D22CH3PR14MB6202namp_"

Received

from DM3PPF3367D7B9B.namprd10.prod.outlook.com (::1) by BYAPR10MB3062.namprd10.prod.outlook.com with HTTPS; Thu, 6 Aug 2026 15:48:00 +0000

from CH2PR16CA0015.namprd16.prod.outlook.com (2603:10b6:610:50::25) by DM3PPF3367D7B9B.namprd10.prod.outlook.com (2603:10b6:f:fc00::c1a) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Thu, 6 Aug 2026 15:47:07 +0000

from DS2PEPF000061C1.namprd02.prod.outlook.com (2603:10b6:610:50:cafe::9a) by CH2PR16CA0015.outlook.office365.com (2603:10b6:610:50::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.21 via Frontend Transport; Thu, 6 Aug 2026 15:47:07 +0000

from CY3PR05CU001.outbound.protection.outlook.com (2a01:111:f403:c112::7) by DS2PEPF000061C1.mail.protection.outlook.com (2603:10b6:f:fc00::214) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.315.6 via Frontend Transport; Thu, 6 Aug 2026 15:47:06 +0000

from CH3PR14MB6202.namprd14.prod.outlook.com (2603:10b6:610:142::20) by CY8PR14MB6315.namprd14.prod.outlook.com (2603:10b6:930:9f::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.21; Thu, 6 Aug 2026 15:47:03 +0000

from CH3PR14MB6202.namprd14.prod.outlook.com ([fe80::4c4:64ad:b197:9cd0]) by CH3PR14MB6202.namprd14.prod.outlook.com ([fe80::4c4:64ad:b197:9cd0%3]) with mapi id 15.21.0292.019; Thu, 6 Aug 2026 15:47:03 +0000

Received-Spf

Pass (protection.outlook.com: domain of ao-inc.com designates 2a01:111:f403:c112::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c112::7; helo=CY3PR05CU001.outbound.protection.outlook.com; pr=C

Message-Id

<CH3PR14MB620298F502362572C2160918A1D22@CH3PR14MB6202.namprd14.prod.outlook.com>

Extracted URLs

file http://www.rfmw.com/

RFMW-protected.pdf

SHA256 b81c10dbea6927ace57e265c47977de6b10a842a19a4fe960ec61c75659aa5a7
MD5 ec1ec237018ef87f10b7075448f90fef
SHA1 227b373f77dbe44338c7f2e79b353ee68411f28d
SHA512 b2a966a06464642b17e4ba67c50b3d362fd77a5543063099c6f407b74ae2eeccdca1735057a65d259d5f767e812b3e9951da93777830000b9f1fe48258060edb
SSDEEP 6144:KO7/OfT1zdmcVIXyk9vVooaeaDDrjt5T2d3WDzC4R8MAgm+V4LPPeTaI9EQW+coo:cfxz9GX5V0eijQ3N4eMyLXeTaIa9+coo
TLSH
T134A423D635D67A3B6F8B10FD970836C7565B452C5600809A1CF0B42BCF86C4FEA85AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

RFMW2026

Extracted URLs

file https://eprfuze.com/fcxd/iT9Gx9gSqKuRcPW7HgfMDBqptX1bpEVtm6Us

email-html-2.txt

SHA256 5453470504a61839bacbda470fc39ee374a647a4654a4114575e84b42084e72e
MD5 5700e32bee37938c621545bef03721c9
SHA1 c6afffa446b780a2438ac822181a93142e27b982
SHA512 aa97e0c5a3c2260601a7280bb8448f22c5899df8c7e8f5528ca1927df643bf3b1ac58612a632bb9adb14a2a4f7f79c7bc183b8af7f73cb524601a22e15c4a712
SSDEEP 192:eti5XdBgZu+9W99vl3fjoj950BrWyfbv0OQp9xrPq:/yu+9W99t3fjoj950RWyfbvBQp3rPq
TLSH
T145D19522FA080C4760F7A1FAF17617196484E91D935B3460F2B676B7F9CACF23684359
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 74f846ba8aef2ee3a0d2e83e12a111e948abd9c89d7a72f093f916850e697363
MD5 164553ffe577200321c27198482b7084
SHA1 375cf3216092d75605a63f1e100b0736858359ec
SHA512 d937fb6e7ba23010c7c101bdb668ebea764b691642b55ec143d61712577fc98c06e75fbaf8155ffef8dd009d126683dbe90f0ee6a9335764fecad23439e6e0c1
TLSH
T172F0029D500743F20253F051DE145F426B12A0BFD647DFC279A9A7BD135AE00718D78C
MD5 SHA1 SHA512 TLSH

image001.jpg

SHA256 4db83ed5978fda785de7e1383acb07c4a23d94112aa7d677eb32d0718038c1b4
MD5 9d7a9d8353e8b077b49a58b8474b927e
SHA1 1daed8dd5f77c39881636b26054757125ea832b1
SHA512 e07a7fe1b38d5cc331dd7f2fb32f0c5f289b303c797f01cac88c278de341e49a8ecd10bc1a5bb78b2a31518c2d5a3df3cf0bd6d245c1f8fdc9d9081a58e51016
TLSH
T1AD513B336B80AD00CD3DF4BB8C4B7A1174D0DF15791E565AFA614351C2A1F67C1D87A8
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

QuarantineMessage (20).zip

faadfc3e-98f5-47df-86e2-08def3d1f837/516f161a-8abd-4522-110b-03cdaa417fc3.eml

Email Headers

Extracted URLs

RFMW-protected.pdf

Extracted URLs

email-html-2.txt

email-plain-1.txt

image001.jpg