Overview

overview

3

Static

static

3

Signed 31-...1).pdf

windows10-2004-x64

3

Signed 31-...1).pdf

windows11-ltsc_2024-x64

3

Signed App...1).pdf

windows10-2004-x64

3

Signed App...1).pdf

windows11-ltsc_2024-x64

3

Signed Sub...1).pdf

windows10-2004-x64

3

Signed Sub...1).pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    c8e9dbaf-171e-8905-6ed0-510bce611da1.eml
  • Size 1.4MB
  • Sample261002-vrexbatvdx
  • SHA256 0b0fd8b7292e4265000053d32b0bb7fc434a025673410706d042e3515efbe779
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • c8e9dbaf-171e-8905-6ed0-510bce611da1.eml
    .eml 1.4MB
  • Signed 31-8593614ccabc-7990-4fcd-9eac-e359e159a037pdf_260930_121932 (1).pdf
    .pdf 303KB
  • Signed Application_Memorandum of Home Insurance_260930_121542 (1).pdf
    .pdf 508KB
  • Signed Subscription Agreement_260930_120822 (1).pdf
    .pdf 193KB
  • email-html-2.txt
    .html 1KB
  • email-plain-1.txt
    532B

c8e9dbaf-171e-8905-6ed0-510bce611da1.eml

  • SHA256 0b0fd8b7292e4265000053d32b0bb7fc434a025673410706d042e3515efbe779
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

CAA1y2dC64gL-Exd9nzzH+[email protected]

Return-Path

[email protected]

Date

Thu, 01 Oct 2026 07:31:55 +0900

Subject

=?utf-8?B?Rlc6IOuztO2XmOyEnOulmCDsoITsnpDshJzrqoXrs7g=?=

Content-Type

multipart/mixed; boundary="-----Boundary-WM=_7f55391f8700.1790807516031"

Received

from BYAPR21CA0017.namprd21.prod.outlook.com (2603:10b6:a03:114::27) by DM4PR20MB5727.namprd20.prod.outlook.com (2603:10b6:8:105::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Wed, 30 Sep 2026 22:32:00 +0000

from MWH0EPF000A6732.namprd04.prod.outlook.com (2603:10b6:a03:114:cafe::32) by BYAPR21CA0017.outlook.office365.com (2603:10b6:a03:114::27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.6 via Frontend Transport; Wed, 30 Sep 2026 22:31:59 +0000

from cvsmtppost31.nm.naver.com (114.111.35.166) by MWH0EPF000A6732.mail.protection.outlook.com (10.167.249.24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 22:31:57 +0000

from cvsendbo002.nm ([10.112.20.42]) by cvsmtppost31.nm.naver.com with ESMTP id DCJKALFVSsanO54MSNE2yQ for <[email protected]>; Wed, 30 Sep 2026 22:31:56 -0000

Received-Spf

Pass (protection.outlook.com: domain of naver.com designates 114.111.35.166 as permitted sender) receiver=protection.outlook.com; client-ip=114.111.35.166; helo=cvsmtppost31.nm.naver.com; pr=C

Message-Id

<[email protected]>