Resubmissions

21/08/2026, 01:33

260821-by2j4sel7y6

21/08/2026, 01:30

260821-bw2gbszfjh6

21/08/2026, 01:27

260821-bt8gvstxct6

21/08/2026, 01:22

260821-brmglszena6

21/08/2026, 01:19

260821-bps7datwdz6

21/08/2026, 01:16

260821-bmz7xazdqa6

General

  • Target
    f2c90af9-428e-7373-5565-52ecb4ff11ed.eml
  • Size 17.9MB
  • Sample260821-bps7datwdz
  • SHA256 6fc5627c81cca20ec365d76448db252d1ec7b5be22a4b7e12591114825a4b75a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
pdf

Malware Config

Signatures

  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • f2c90af9-428e-7373-5565-52ecb4ff11ed.eml
    .eml 17.9MB
  • 20260819 Hearing Bundle.pdf
    .pdf 10.5MB
  • P LOA vF (bookmarked).pdf
    .pdf 2.3MB
  • folder.joboptions
    14KB
  • P Skeleton vF.pdf
    .pdf 271KB
  • email-html-2.txt
    .html 9KB
  • email-plain-1.txt
    979B
  • image001.png
    .png 8KB

f2c90af9-428e-7373-5565-52ecb4ff11ed.eml

  • SHA256 6fc5627c81cca20ec365d76448db252d1ec7b5be22a4b7e12591114825a4b75a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

TYZPR01MB689839AEC595EE57D191453ED0A42@TYZPR01MB6898.apcprd01.prod.exchangelabs.com

Return-Path

[email protected]

Date

Thu, 20 Aug 2026 10:25:41 +0000

Subject

RE: HCMP 1380 of 2026

Content-Type

multipart/mixed; boundary="_008_TYSPR01MB71341393229101273F3F6449CDA42TYSPR01MB7134apcp_"

Received

from YT4PR01CA0235.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:eb::23) by YT2PR01MB9524.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:dc::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.10; Thu, 20 Aug 2026 10:28:45 +0000

from TO1PEPF00005347.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:eb:cafe::81) by YT4PR01CA0235.outlook.office365.com (2603:10b6:b01:eb::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.10 via Frontend Transport; Thu, 20 Aug 2026 10:28:45 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (91.220.42.227) by TO1PEPF00005347.mail.protection.outlook.com (10.167.241.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.3 via Frontend Transport; Thu, 20 Aug 2026 10:28:44 +0000

from SEYPR02CU001.outbound.protection.outlook.com (mail-koreacentralazon11023109.outbound.protection.outlook.com [40.107.44.109]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-47-HSSs6aQYOUyysIWXWc8VjQ-2; Thu, 20 Aug 2026 11:26:09 +0100

from TYSPR01MB7134.apcprd01.prod.exchangelabs.com (2603:1096:405:120::13) by TY0PR0101MB4189.apcprd01.prod.exchangelabs.com (2603:1096:400:1bb::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 10:25:53 +0000

from TYSPR01MB7134.apcprd01.prod.exchangelabs.com ([fe80::4051:da03:e6ea:a91e]) by TYSPR01MB7134.apcprd01.prod.exchangelabs.com ([fe80::4051:da03:e6ea:a91e%5]) with mapi id 15.21.0339.007; Thu, 20 Aug 2026 10:25:53 +0000

Received-Spf

Fail (protection.outlook.com: domain of kenixyuen.hk does not designate 91.220.42.227 as permitted sender) receiver=protection.outlook.com; client-ip=91.220.42.227; helo=eu-smtp-inbound-delivery-1.mimecast.com;

Message-Id

<TYSPR01MB71341393229101273F3F6449CDA42@TYSPR01MB7134.apcprd01.prod.exchangelabs.com>

Extracted URLs

  • file https://url.uk.m.mimecastprotect.com/s/5U97CJyYkh9Z8lYHVf34hyXXgQ?domain=dentons.com