Overview

overview

4

Static

static

4

Servicios ...26.pdf

windows10-2004-x64

3

Servicios ...26.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    1790378697-104927-32690-128177-1.eml
  • Size 14.5MB
  • Sample260928-vd8bpszvay
  • SHA256 427fae3b97630735e08ab3f850569073577f68fb17e1dd43ff4a7f5f7573aa74
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
pdflinkqr

Malware Config

Signatures

  • PDF has QR code that contains a HTTP URL

    PDFs with URL QR codes are often used for phishing

    pdfqr
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • 1790378697-104927-32690-128177-1.eml
    .eml 14.5MB
  • Servicios TPC GT 2026.pdf
    .pdf 10.0MB
  • email-html-2.txt
    6KB
  • email-plain-1.txt
    1KB
  • image.png
    .png 595KB

1790378697-104927-32690-128177-1.eml

  • SHA256 427fae3b97630735e08ab3f850569073577f68fb17e1dd43ff4a7f5f7573aa74
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

CAGKRv2aUPgckranZoCub4ik6Wg+[email protected]

Date

Fri, 25 Sep 2026 17:24:05 -0600

Subject

=?UTF-8?Q?Asesor=C3=ADa_de_Precios_de_Transferencia?=

Content-Type

multipart/mixed; boundary="00000000000086d779065c5705b5"

Received

from mail-ua1-f45.google.com (mail-ua1-f45.google.com [209.85.222.45]) by mx-inbound-ea19-63.us-east-2b.ess.aws.cudaops.com (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 25 Sep 2026 23:24:57 +0000

by mail-ua1-f45.google.com with SMTP id a1e0cc1a2514c-98515937bcdso1127261241.1 for <[email protected]>; Fri, 25 Sep 2026 16:24:57 -0700 (PDT)

X-Received

by 2002:a05:6820:f09:b0:6c3:23f1:9b11 with SMTP id 006d021491bc7-6d440df14eemr5637048eaf.23.1790378684804; Fri, 25 Sep 2026 16:24:44 -0700 (PDT)

Received-Spf

pass (mx-inbound-ea19-63.us-east-2b.ess.aws.cudaops.com: domain of [email protected] designates 209.85.222.45 as permitted sender)

Message-Id

<CAGKRv2aVEi_LcQmZ-tsYzSGBH1yig8RMywwCtchXa05CAUPKBA@mail.gmail.com>

Extracted URLs

  • file http://www.tpconsulting.com/

  • file https://forms.office.com/r/iKjDkM7uqi

  • file https://linkprotect.cudasvc.com/url?a=

  • file https://pe.linkedin.com/company/tp-consulting-int

  • file https://tpconsulting.com/