attachment20260930-1092870-ddoxbn[.]zip

attachment20260930-1092870-ddoxbn.zip

SHA256 71c10330def17eb20f1467c5b85923f1c2465591321e5ee39ff3dcb735f5086e
MD5 61de56a71a28aca41660846f1d3fd77c
SHA1 6ddc87cf7621c4fb8e22a386c2af72ee69a49221
SHA512 094bd4f65b609f71e23f5e99c9175d40ca715d09ffaaca220aa09e7798b4940324d47db7c9343afc3472cde41da745506ceb6f9f4084b52ad69cec88fbb4235b
SSDEEP 1536:ZdFQy59QyfJCc5otccVSkWnFfD6PJVsazGlECsRTrnzqcsOlCLM1xqbi5cKE:ZdFQyzQGzqVVSkWnIPRzGDq2JKqm5cKE
TLSH
T17C83029AFED71B0F141FE3CCCB9EE4309D65B145911A1E0554910A5ACCF933DAA02EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Only_Excel_Validating_fix_BUG_Triage_fails_to_decode_.svg_QR_codes_embedded_in_Excel_files..eml

SHA256 ba72c0f8a5990a2e8ade427ecfed431b265a3f0ed43879e2286777d8f440bfc7
MD5 1b3e9f0c22948b73bdaea975ae3bc87a
SHA1 1733f9c1526842b5e0d88184361e1f401087d80f
SHA512 4d4a8160649de09fb6b3a5370db018f29d122a5a2079b97b5b08e2e094f7776fee275953861b965a33a3cb56ac341af9d5caea05feb757e0d8d0a13a55aa073d
SSDEEP 3072:4fskFoEzl/s8MSWeK9XJf+vXR5jTuNB20mfurajuRUqfl0RUXA/T8:4kkFogl/s8d+v+zj30mfurajQUPRQAr8
TLSH
T1D0047273D85F61C3431C2BEFB146A6C1DCD0FBBB5D4FE204A0D640B966DA5CC9189AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

In-Reply-To

PH0PR11MB56431F82CFF1B7CA8F3DFA63B4FAA@PH0PR11MB5643.namprd11.prod.outlook.com

Return-Path

[email protected]

Date

Wed, 29 Oct 2025 19:13:33 +0000

Subject

Only Excel: Validating fix: [BUG] Triage fails to decode .svg QR codes embedded in Excel files.

Content-Type

multipart/mixed; boundary="_004_PH0PR11MB5643304CDCF73E59B23DBC92B4FAAPH0PR11MB5643namp_"

Received

from SN7PR05MB9670.namprd05.prod.outlook.com (2603:10b6:806:342::10) by DS2PR05MB998328.namprd05.prod.outlook.com with HTTPS; Wed, 29 Oct 2025 19:14:03 +0000

from MW4PR04CA0348.namprd04.prod.outlook.com (2603:10b6:303:8a::23) by SN7PR05MB9670.namprd05.prod.outlook.com (2603:10b6:806:342::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9253.18; Wed, 29 Oct 2025 19:13:39 +0000

from MWH0EPF000989E9.namprd02.prod.outlook.com (2603:10b6:303:8a:cafe::50) by MW4PR04CA0348.outlook.office365.com (2603:10b6:303:8a::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9275.13 via Frontend Transport; Wed, 29 Oct 2025 19:13:39 +0000

from SA9PR02CU001.outbound.protection.outlook.com (2a01:111:f403:c10c::1) by MWH0EPF000989E9.mail.protection.outlook.com (2603:10b6:329:400:0:1002:0:8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9275.10 via Frontend Transport; Wed, 29 Oct 2025 19:13:38 +0000

from PH0PR11MB5643.namprd11.prod.outlook.com (2603:10b6:510:d5::21) by CY8PR11MB6866.namprd11.prod.outlook.com (2603:10b6:930:5e::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9275.12; Wed, 29 Oct 2025 19:13:34 +0000

from PH0PR11MB5643.namprd11.prod.outlook.com ([fe80::f783:a54c:8159:7678]) by PH0PR11MB5643.namprd11.prod.outlook.com ([fe80::f783:a54c:8159:7678%4]) with mapi id 15.20.9275.013; Wed, 29 Oct 2025 19:13:33 +0000

Received-Spf

Pass (protection.outlook.com: domain of cofense.com designates 2a01:111:f403:c10c::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c10c::1; helo=SA9PR02CU001.outbound.protection.outlook.com; pr=C

Message-Id

<PH0PR11MB5643304CDCF73E59B23DBC92B4FAA@PH0PR11MB5643.namprd11.prod.outlook.com>

email-html-2.txt

SHA256 76257d7260a9cb291d58cd2e9205f2859423c6f839188e1feb4d94e5c53b0c47
MD5 0b0313be002a1c6200dc1eec280b7cde
SHA1 9c36a3654bc4d49490ad7fefe9d2901b7e1ab5e4
SHA512 79fe899b1e6f7e47b2ab909ae6a70bbb338cfde00d549a64e9b544280bc3f7dba7f3ac3062f9a291919923086333ce63a1e3e339eb151877cecfcc0cc594d5b3
TLSH
T1D3419C03B340054752D36E3CE593F7DA6E8A9684510B646728B0725BDCEE82592F338C
MD5 SHA1 SHA512 TLSH

email-plain-1.txt

SHA256 66be2355ab0513e730d45ccac75b9b0eddde7d6196cb0524333dc0d94424a8ee
MD5 a9ebd7cee4ad865e17b9c8f291248dde
SHA1 feeb6e7ff356fee5a8165b6a3f314ab0253943ea
SHA512 b78546b56a727054e53177a6ba65ba995791f088f6e445218ba8f1f462900060d2d3057e5c6bb30d385646eedff647e08d18c984cf7d600ce36deb913e6c13a3
TLSH
T123E07D737B00069394831895BC99C551A12A071C904A32024C7D911C20B104D93BB3ED
MD5 SHA1 SHA512 TLSH

xlsx embedded qr codes.xlsx

SHA256 4fc50abe4214a380c881eb7b71ec71d2ee63a4ce87138e008dbe800a298df280
MD5 bb6322859e1cc993ffe60eb2325d9495
SHA1 7d6387b3c3748b33ea33d61963004fe4c601676a
SHA512 72148e5dcc2d6a1d28e941a846cd9c700086bb8f3fe0f1460b88086eca7201982a0705db45d6667665ef6b643798bcf1b21223949a2d4f05052c03cdf08f79fb
SSDEEP 1536:klYSVNHKTVOPDkU2EKA4HDSFHeEQHCr46pkwY9nA4USn9RcLHvs5dOF+RKwm+nuj:kxVNHKTVQYUkEQoYNJ90HvEkF+D/nH4n
TLSH
T17FB361988C7AA00DD0773FB49BB6A095E771F6A13F0E5E1B02AC74741EAEC39D781445
MD5 SHA1 SHA512 SSDEEP TLSH

office2007

Sharing

General

Malware Config

Signatures

File Explorer