Overview

overview

3

Static

static

3

Northeast_...-5.pdf

windows10-2004-x64

3

Northeast_...-5.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Attachments.eml
  • Size 1.0MB
  • Sample260824-lwebxawanf
  • SHA256 4a1ad0bec6d8d0a7e9850b28e5cf603057ee6c9a62e590f0990130bb4021cba3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • Attachments.eml
    .eml 1.0MB
  • Northeast_Vacation_Club_Site_Arrival_R3fW5cD2-202608150940-0004-5.pdf
    .pdf 763KB
  • email-html-2.txt
    .html 8KB
  • email-plain-1.txt
    696B

Attachments.eml

  • SHA256 4a1ad0bec6d8d0a7e9850b28e5cf603057ee6c9a62e590f0990130bb4021cba3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Fri, 21 Aug 2026 17:01:37 +0000

Subject

For Your Reservation

Content-Type

multipart/mixed; boundary="_004_DS2PR18MB92759356257504432D571432DAC0A32DS2PR18MB927593_"

Received

from IA3PR11MB053507.namprd11.prod.outlook.com (::1) by DM6PR11MB2940.namprd11.prod.outlook.com with HTTPS; Fri, 21 Aug 2026 17:01:47 +0000

from MW4PR03CA0132.namprd03.prod.outlook.com (2603:10b6:303:8c::17) by IA3PR11MB053507.namprd11.prod.outlook.com (2603:10b6:208:620::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.11; Fri, 21 Aug 2026 17:01:43 +0000

from CO1PEPF000066E9.namprd05.prod.outlook.com (2603:10b6:303:8c:cafe::1e) by MW4PR03CA0132.outlook.office365.com (2603:10b6:303:8c::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.10 via Frontend Transport; Fri, 21 Aug 2026 17:01:43 +0000

from esa.hc6805-81.iphmx.com (68.232.154.195) by CO1PEPF000066E9.mail.protection.outlook.com (10.167.249.11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Fri, 21 Aug 2026 17:01:43 +0000

from mail-eastus2azon11020123.outbound.protection.outlook.com (HELO BN1PR04CU002.outbound.protection.outlook.com) ([52.101.56.123]) by esa4.hc6805-81.iphmx.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 21 Aug 2026 13:01:41 -0400

from DS2PR18MB927593.namprd18.prod.outlook.com (2603:10b6:8:334::16) by MW3PR18MB3564.namprd18.prod.outlook.com (2603:10b6:303:58::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Fri, 21 Aug 2026 17:01:38 +0000

from DS2PR18MB927593.namprd18.prod.outlook.com ([fe80::144d:6a36:580f:1348]) by DS2PR18MB927593.namprd18.prod.outlook.com ([fe80::144d:6a36:580f:1348%3]) with mapi id 15.21.0339.007; Fri, 21 Aug 2026 17:01:37 +0000

Received-Spf

SoftFail (esa.hc6805-81.iphmx.com: domain of [email protected] is inclined to not designate 52.101.56.123 as permitted sender) identity=mailfrom; client-ip=52.101.56.123; receiver=esa.hc6805-81.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible.downgrade_pra; x-record-type="v=spf1"; x-record-text="v=spf1 include:_spf.google.com ~all"

Message-Id

<DS2PR18MB92759356257504432D571432DAC0A32@DS2PR18MB927593.namprd18.prod.outlook.com>