Overview

overview

3

Static

static

3

Fact-sheet...ts.pdf

windows10-2004-x64

3

Fact-sheet...ts.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    attachment - 2026-09-29T050401.396.eml
  • Size 305KB
  • Sample260928-3mnbwsxt8j
  • SHA256 1d350d907895881ee5f3e9a63b0da7a6c754c22f053c10499d3b209d2567f415
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

    pdf

File Explorer

  • attachment - 2026-09-29T050401.396.eml
    .eml 305KB
  • Fact-sheets-agency-agreements.pdf
    .pdf 207KB
  • email-html-1.txt
    .html 10KB

attachment - 2026-09-29T050401.396.eml

  • SHA256 1d350d907895881ee5f3e9a63b0da7a6c754c22f053c10499d3b209d2567f415
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Mon, 28 Sep 2026 00:41:49 -0500

Subject

Sales Agreement for 37 Bohenia Crescent, Moree NSW 2400

Content-Type

multipart/mixed; boundary="_002_xKo0jZNlRJicOgV5XkPjAgeopodismtpd5_"

Received

from SY7P282MB5039.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:2a8::20) by SY6P282MB3154.AUSP282.PROD.OUTLOOK.COM with HTTPS; Mon, 28 Sep 2026 05:44:47 +0000

from YT1PR01CA0075.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2d::14) by SY7P282MB5039.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:2a8::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.23; Mon, 28 Sep 2026 05:44:44 +0000

from YT1PR01MB9356.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2d:cafe::83) by YT1PR01CA0075.outlook.office365.com (2603:10b6:b01:2d::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.23 via Frontend Transport; Mon, 28 Sep 2026 05:44:42 +0000

from YQBPR0101CA0156.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:e::29) by YT1PR01MB9356.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:ab::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Mon, 28 Sep 2026 05:44:02 +0000

from QB1PEPF00004E08.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:e:cafe::21) by YQBPR0101CA0156.outlook.office365.com (2603:10b6:c01:e::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.24 via Frontend Transport; Mon, 28 Sep 2026 05:44:02 +0000

from eu-smtp-inbound-delivery-1.mimecast.com (91.220.42.227) by QB1PEPF00004E08.mail.protection.outlook.com (10.167.240.22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 28 Sep 2026 05:44:01 +0000

from o1.ptr4289.flkitover.com (o1.ptr4289.flkitover.com [167.89.74.162]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id uk-mta-125-gMR1BAU8NZi0X80ohfIdHw-1; Mon, 28 Sep 2026 06:43:43 +0100

by recvd-8685d6fbd-wsk2x with SMTP id recvd-8685d6fbd-wsk2x-1-6AB9FE1D-6A 2026-09-28 05:41:49.859999336 +0000 UTC m=+294309.272630408

from MTg5NzA2Nzg (unknown) by geopod-ismtpd-5 (SG) with HTTP id xKo0jZNlRJicOgV5XkP-jA Mon, 28 Sep 2026 05:41:49.707 +0000 (UTC)

Received-Spf

Fail (protection.outlook.com: domain of em3804.flkitover.com does not designate 91.220.42.227 as permitted sender) receiver=protection.outlook.com; client-ip=91.220.42.227; helo=eu-smtp-inbound-delivery-1.mimecast.com;

Message-Id

<xKo0jZNlRJicOgV5XkP-jA@geopod-ismtpd-5>

Extracted URLs

  • file https://url.uk.m.mimecastprotect.com/s/6w2XCG52PIoO6WYc0ummiBpDFM?domain=url6204.flkitover.com

  • file https://url.uk.m.mimecastprotect.com/s/qRa4CL82XI5w7Nju1HDDiy2ZkC?domain=url6204.flkitover.com

  • file https://url.uk.m.mimecastprotect.com/s/r-oFCKZ2Wc0M68ECnFBBi5SQnb?domain=url6204.flkitover.com

  • file https://url.uk.m.mimecastprotect.com/s/xXsWCJq2VCPAVprupC33iy9kFb?domain=url6204.flkitover.com