Overview

overview

3

Static

static

3

Merbes-le-...43.pdf

windows10-2004-x64

3

Merbes-le-...43.pdf

windows11-ltsc_2024-x64

3

Resubmissions

25/09/2026, 08:58

260925-kxdlbsty7p3

25/09/2026, 08:49

260925-kq2dtaxtcx4

Sharing

Copy URL Twitter E-mail

General

  • Target
    !Merbes-le-Château RFP Invitation officielle à soumettre une proposition Référence P-910056.msg
  • Size 247KB
  • Sample260925-kxdlbsty7p
  • SHA256 06e10cd6374f6dcc64e8d0f8f2e8de5484bf8d5eab3854336d68bdeec23c0f37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • !Merbes-le-Château RFP Invitation officielle à soumettre une proposition Référence P-910056.msg
    .msg 247KB
  • Merbes-le-Château RFP Invitation officielle à soumettre une proposition – Référence P-91005643.pdf
    .pdf 6KB
  • image.png
    .png 53KB

!Merbes-le-Château RFP Invitation officielle à soumettre une proposition Référence P-910056.msg

  • SHA256 06e10cd6374f6dcc64e8d0f8f2e8de5484bf8d5eab3854336d68bdeec23c0f37
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 24 Sep 2026 09:12:31 +0000

Subject

=?utf-8?B?LyFcOk1lcmJlcy1sZS1DaGHMgnRlYXUgUkZQIEludml0YXRpb24gb2ZmaWNp?= =?utf-8?B?ZWxsZSBhzIAgc291bWV0dHJlIHVuZSBwcm9wb3NpdGlvbiDigJMgUmXMgWZl?= =?utf-8?B?zIFyZW5jZSBQLTkxMDA1NjQzLnBkZg==?=

Content-Type

multipart/mixed; boundary="_006_AM0PR10MB326721123D7E0CE90B68E4FAEF812AM0PR10MB3267EURP_"

Received

from VI2PR04MB10836.eurprd04.prod.outlook.com (2603:10a6:800:276::6) by AM6PR04MB5080.eurprd04.prod.outlook.com with HTTPS; Thu, 24 Sep 2026 09:13:05 +0000

from PAZP264CA0166.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:236::6) by VI2PR04MB10836.eurprd04.prod.outlook.com (2603:10a6:800:276::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:12:39 +0000

from MAD0EPF000008C6.eurprd05.prod.outlook.com (2603:10a6:102:236:cafe::83) by PAZP264CA0166.outlook.office365.com (2603:10a6:102:236::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Thu, 24 Sep 2026 09:12:39 +0000

from mail.rrn.fgov.be (193.191.221.153) by MAD0EPF000008C6.mail.protection.outlook.com (10.167.241.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 09:12:39 +0000

from mail-francecentralazon11023077.outbound.protection.outlook.com (HELO PA4PR04CU001.outbound.protection.outlook.com) ([40.107.162.77]) by mail.rrn.fgov.be with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Sep 2026 11:12:37 +0200

from AM0PR10MB3267.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:186::11) by GV1PR10MB8369.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:1c9::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:12:31 +0000

from AM0PR10MB3267.EURPRD10.PROD.OUTLOOK.COM ([fe80::f385:b302:146c:97ab]) by AM0PR10MB3267.EURPRD10.PROD.OUTLOOK.COM ([fe80::f385:b302:146c:97ab%5]) with mapi id 15.21.0451.014; Thu, 24 Sep 2026 09:12:31 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning commune-merbes-le-chateau.be discourages use of 40.107.162.77 as permitted sender)

None (mail.rrn.fgov.be: no sender authenticity information available from domain of [email protected]) identity=pra; client-ip=40.107.162.77; receiver=mail.rrn.fgov.be; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible.downgrade_pra

SoftFail (mail.rrn.fgov.be: domain of [email protected] is inclined to not designate 40.107.162.77 as permitted sender) identity=mailfrom; client-ip=40.107.162.77; receiver=mail.rrn.fgov.be; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible.downgrade_pra; x-record-type="v=spf1"; x-record-text="v=spf1 include:outlook.com ~all"

Pass (mail.rrn.fgov.be: domain of [email protected] designates 40.107.162.77 as permitted sender) identity=helo; client-ip=40.107.162.77; receiver=mail.rrn.fgov.be; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=sidf_compatible.downgrade_pra; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all"

Message-Id

<AM0PR10MB326721123D7E0CE90B68E4FAEF812@AM0PR10MB3267.EURPRD10.PROD.OUTLOOK.COM>

Extracted URLs

  • file http://www.merbeslechateau.be

  • file http://www.merbeslechateau.be/