General

  • Target
    attachment (74).eml
  • Size 1.5MB
  • Sample260814-qlpgcavanb
  • SHA256 1b7eb9c40c3807af3f2c3db2cdb8f1164b2f0fe6354a54376cf65d948204b2d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

File Explorer

  • attachment (74).eml
    .eml 1.5MB
  • Attachments.zip
    .zip 1.1MB
  • Dentons_Nabídka_Posouzení datové karantény RB_Fáze 1.pdf
    .pdf 1.1MB
  • PO_897_85062305_0_CS.pdf
    .pdf 19KB
  • email-html-1.txt
    .html 5KB

attachment (74).eml

  • SHA256 1b7eb9c40c3807af3f2c3db2cdb8f1164b2f0fe6354a54376cf65d948204b2d5
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Fri, 14 Aug 2026 14:32:59 +0200 (CEST)

Subject

=?UTF-8?Q?Pro_informaci:_NURBCZ_-_Raiffeisenbank_-_Prag?= =?UTF-8?Q?ue_-_Standardn=C3=AD_n=C3=A1kupn=C3=AD?= =?UTF-8?Q?_objedn=C3=A1vka_85062305,_0?=

Content-Type

multipart/mixed; boundary="----=_Part_484264_705258399.1786710778059"

Received

from AS1PR05MB9465.eurprd05.prod.outlook.com (::1) by AM7PR05MB6994.eurprd05.prod.outlook.com with HTTPS; Fri, 14 Aug 2026 12:41:40 +0000

from YQZPR01CA0160.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:8c::15) by AS1PR05MB9465.eurprd05.prod.outlook.com (2603:10a6:20b:4d3::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.15; Fri, 14 Aug 2026 12:41:38 +0000

from YQ1PR01MB11464.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:8c:cafe::7c) by YQZPR01CA0160.outlook.office365.com (2603:10b6:c01:8c::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.16 via Frontend Transport; Fri, 14 Aug 2026 12:41:37 +0000

from YT4PR01CA0458.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d6::11) by YQ1PR01MB11464.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:b8::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.16; Fri, 14 Aug 2026 12:40:46 +0000

from YT2PEPF000001C8.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d6:cafe::28) by YT4PR01CA0458.outlook.office365.com (2603:10b6:b01:d6::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.315.16 via Frontend Transport; Fri, 14 Aug 2026 12:40:45 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (195.130.217.221) by YT2PEPF000001C8.mail.protection.outlook.com (10.167.241.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.3 via Frontend Transport; Fri, 14 Aug 2026 12:40:43 +0000

from emgwrbi01.mdcs.at (emgwrbi01.mdcs.at [217.13.191.76]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-266-ZoXX5vsgPoyBI058cRVoNg-1; Fri, 14 Aug 2026 13:40:28 +0100

from localhost (localhost [127.0.0.1]) by emgwrbi01.mdcs.at (Postfix) with ESMTP id DF61E40F7F for <[email protected]>; Fri, 14 Aug 2026 14:33:00 +0200 (CEST)

from emgwrbi01.mdcs.at ([127.0.0.1]) by localhost (rbi02-1pl-rbe01.rbi.group [127.0.0.1]) (amavis, port 10024) with ESMTP id HNkw3dW-mFhC for <[email protected]>; Fri, 14 Aug 2026 14:32:59 +0200 (CEST)

from smtp01.at.rzb.rbg.cc (unknown [10.7.59.242]) by emgwrbi01.mdcs.at (Postfix) with ESMTPS id 319F440034 for <[email protected]>; Fri, 14 Aug 2026 14:32:59 +0200 (CEST)

by smtp01.at.rzb.rbg.cc (Postfix, from userid 107) id 25EB92081C; Fri, 14 Aug 2026 14:32:59 +0200 (CEST)

from sl1p0ebs11.rbi.group (unknown [10.7.69.3]) by smtp01.at.rzb.rbg.cc (Postfix) with ESMTP id 1046D207A2 for <[email protected]>; Fri, 14 Aug 2026 14:32:59 +0200 (CEST)

Received-Spf

Fail (protection.outlook.com: domain of rbinternational.com does not designate 195.130.217.221 as permitted sender) receiver=protection.outlook.com; client-ip=195.130.217.221; helo=eu-smtp-inbound-delivery-1.mimecast.com;

Message-Id

<[email protected]>