General

  • Target
    b077f8ad-e979-779a-386e-d9e74402813b.eml
  • Size 1.6MB
  • Sample260930-k2j9nsbd38
  • SHA256 fcd2890fa87d4c531176896bf672b52e010aa9b2bc2b3467dcadd5bb4d4ad6cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • PDF has QR code that contains a HTTP URL

    PDFs with URL QR codes are often used for phishing

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

File Explorer

  • b077f8ad-e979-779a-386e-d9e74402813b.eml
    .eml 1.6MB
  • Attendance Taking user-guide-for-trainee-async.pdf
    .pdf 433KB
  • SRS core CPD e-Learning Access Guide.pdf
    .pdf 707KB
  • email-html-2.txt
    12KB
  • email-plain-1.txt
    3KB

b077f8ad-e979-779a-386e-d9e74402813b.eml

  • SHA256 fcd2890fa87d4c531176896bf672b52e010aa9b2bc2b3467dcadd5bb4d4ad6cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

Return-Path

[email protected]

Date

Tue, 1 Sep 2026 14:16:43 +0800

Subject

Access and Attendance Taking for SRS core CPD e-Learning

Content-Type

multipart/mixed; boundary="00000000000027bed8065a65dfcc"

Received

from PUVP216CA0013.KORP216.PROD.OUTLOOK.COM (2603:1096:301:16f::14) by SEZPR06MB5558.apcprd06.prod.outlook.com (2603:1096:101:cc::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 06:17:26 +0000

from TY2PEPF0000AB89.apcprd03.prod.outlook.com (2603:1096:301:16f:cafe::38) by PUVP216CA0013.outlook.office365.com (2603:1096:301:16f::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 06:17:26 +0000

from mail-yx1-xb132.google.com (2607:f8b0:4864:20::b132) by TY2PEPF0000AB89.mail.protection.outlook.com (2603:1096:408::d07) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 06:17:25 +0000

by mail-yx1-xb132.google.com with SMTP id 956f58d0204a3-66d15f22652so670770d50.2 for <[email protected]>; Mon, 31 Aug 2026 23:17:25 -0700 (PDT)

X-Received

by 2002:a53:acd4:0:10b0:668:99ce:a033 with SMTP id 956f58d0204a3-66e4c6db51cmr7723854d50.2.1788243442363; Mon, 31 Aug 2026 23:17:22 -0700 (PDT)

Received-Spf

None (protection.outlook.com: abmaximus.com does not designate permitted sender hosts)

Message-Id

<CACU7gqw2amq9AuNj6SKS7eUu76WuQVWsgtVtJMDB7rqdiNpjAA@mail.gmail.com>

Extracted URLs

  • file https://srseducation.abmaximus.com/users/sign_in

  • file https://www.myskillsfuture.gov.sg/spface/splogin/select-session?course-run-code=RA860433

  • file https://www.myskillsfuture.gov.sg/spface/splogin/select-session?course-run-code=RA860439