General

  • Target
    email details.eml
  • Size 567KB
  • Sample260924-rtx9wsvt2p
  • SHA256 7b761d931173ebfca0768ebcd6b7c6581d7acf30d06e6e3ce5346613236f1856
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • email details.eml
    .eml 567KB
  • 09-23-2026 Heather Bolinger IRA Plan.pdf
    .pdf 402KB
  • email-html-2.txt
    .html 5KB
  • email-plain-1.txt
    533B

email details.eml

  • SHA256 7b761d931173ebfca0768ebcd6b7c6581d7acf30d06e6e3ce5346613236f1856
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Wed, 23 Sep 2026 13:46:56 +0000

Subject

{EXTERNAL} IRA Plan

Content-Type

multipart/mixed; boundary="_004_40a940941adaa2e9ab09a55c926d95fecedarcreekpedscom_"

Received

from BY5PR14MB3985.namprd14.prod.outlook.com (::1) by LVXPR14MB958379.namprd14.prod.outlook.com with HTTPS; Wed, 23 Sep 2026 13:47:16 +0000

from BN9PR03CA0681.namprd03.prod.outlook.com (2603:10b6:408:10e::26) by BY5PR14MB3985.namprd14.prod.outlook.com (2603:10b6:a03:201::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Wed, 23 Sep 2026 13:47:08 +0000

from LV8PEPF00000068.namprd03.prod.outlook.com (2603:10b6:408:10e:cafe::e) by BN9PR03CA0681.outlook.office365.com (2603:10b6:408:10e::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.16 via Frontend Transport; Wed, 23 Sep 2026 13:47:06 +0000

from esa.hc5039-89.iphmx.com (207.54.86.173) by LV8PEPF00000068.mail.protection.outlook.com (10.167.248.41) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Wed, 23 Sep 2026 13:47:05 +0000

from smtprelay0252.b.hostedemail.com (HELO relay.b.hostedemail.com) ([64.98.42.252]) by esa5.hc5039-89.iphmx.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 23 Sep 2026 09:47:00 -0400

from omf15.b.hostedemail.com (unknown [10.200.8.249]) by unirelay04.b.hostedemail.com (Postfix) with ESMTP id 759DF1402A6 for <[email protected]>; Wed, 23 Sep 2026 13:46:58 +0000 (UTC)

from [HIDDEN] (Authenticated sender: [email protected]) by omf15.b.hostedemail.com (Postfix) with ESMTPA id 443CB180006 for <[email protected]>; Wed, 23 Sep 2026 13:46:57 +0000 (UTC)

Received-Spf

Pass (esa.hc5039-89.iphmx.com: domain of [email protected] designates 64.98.42.252 as permitted sender) identity=mailfrom; client-ip=64.98.42.252; receiver=esa.hc5039-89.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible.downgrade_pra; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:216.40.44.0/24 ip4:216.40.42.0/24 ip4:64.98.42.0/24 ip4:64.98.36.17 ip4:64.98.36.19 ip4:64.98.36.27 ip4:64.98.36.28/31 ip4:64.98.47.0/24 ip4:64.98.36.30/32 ip4:216.40.34.9/32 ip4:64.99.140.0/24 ~all"

Message-Id

<[email protected]>