Overview

overview

5

Static

static

5

payment_receipt-.pdf

windows10-2004-x64

4

payment_receipt-.pdf

windows11-ltsc_2024-x64

3

Resubmissions

24/08/2026, 19:02

260824-xp6y5abp215

24/08/2026, 18:59

260824-xm9x1aytaw5

Sharing

Copy URL Twitter E-mail

General

  • Target
    Rule detected_ Quarantine Emails based on certain words.msg
  • Size 97KB
  • Sample260824-xp6y5abp21
  • SHA256 5caf1dc6f8060b0401f67afa4b3961cda7dae85ff02f593c4f39f03e699bc605
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf

File Explorer

  • Rule detected_ Quarantine Emails based on certain words.msg
    .msg 97KB
  • payment_receipt-.pdf
    .pdf 14KB

Rule detected_ Quarantine Emails based on certain words.msg

  • SHA256 5caf1dc6f8060b0401f67afa4b3961cda7dae85ff02f593c4f39f03e699bc605
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 10 Aug 2026 14:53:23 +0000

Subject

Transfer receipt attached.

Content-Type

multipart/mixed; boundary="_8c68d8b9-8cd2-4492-b046-cf464425c425_"

Received

from CH2PR03CA0023.namprd03.prod.outlook.com (2603:10b6:610:59::33) by BY5PR17MB3857.namprd17.prod.outlook.com (2603:10b6:a03:239::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Mon, 10 Aug 2026 14:53:38 +0000

from CH3PEPF00000012.namprd21.prod.outlook.com (2603:10b6:610:59:cafe::3) by CH2PR03CA0023.outlook.office365.com (2603:10b6:610:59::33) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.25 via Frontend Transport; Mon, 10 Aug 2026 14:53:37 +0000

from mail.foodxz.com (2a0c:a300:c670:8ec8::1) by CH3PEPF00000012.mail.protection.outlook.com (2603:10b6:61f:fc00::375) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.0 via Frontend Transport; Mon, 10 Aug 2026 14:53:36 +0000

Received-Spf

Fail (protection.outlook.com: domain of foodxz.com does not designate 2a0c:a300:c670:8ec8::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a0c:a300:c670:8ec8::1; helo=mail.foodxz.com;

Message-Id

<[email protected]>

Extracted URLs

  • file http://foodxz.com