Overview

overview

7

Static

static

3

EU Holiday...90.pdf

windows10-2004-x64

7

EU Holiday...90.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    f1c36315-8ef9-b784-ae99-3e96efece85e.eml
  • Size 1.2MB
  • Sample261014-hdxtrazzav
  • SHA256 0a85ddd069056a3f32e505dc60f24d3c5d8518fc151edb2722b3985eb18596e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • f1c36315-8ef9-b784-ae99-3e96efece85e.eml
    .eml 1.2MB
  • EU Holidays Bid Invite #64390.pdf
    .pdf 108KB
  • email-html-2.txt
    .html 5KB
  • email-plain-1.txt
    745B
  • image.png
    .png 801KB

f1c36315-8ef9-b784-ae99-3e96efece85e.eml

  • SHA256 0a85ddd069056a3f32e505dc60f24d3c5d8518fc151edb2722b3985eb18596e3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Wed, 14 Oct 2026 04:50:26 +0000

Subject

EU Holidays - Invitation & Proposal [RESPONSE REQUESTED]

Content-Type

multipart/mixed; boundary="_006_PSAPR02MB52244F24251904F4C1D14A64ED9D2PSAPR02MB5224apcp_"

Received

from OSNPR01MB8126.apcprd01.prod.exchangelabs.com (::1) by SE3PR01MB8105.apcprd01.prod.exchangelabs.com with HTTPS; Wed, 14 Oct 2026 04:52:03 +0000

from SE2P216CA0162.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2cb::7) by OSNPR01MB8126.apcprd01.prod.exchangelabs.com (2603:1096:604:497::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.12; Wed, 14 Oct 2026 04:50:38 +0000

from OSA0EPF000000CD.apcprd02.prod.outlook.com (2603:1096:101:2cb:cafe::2) by SE2P216CA0162.outlook.office365.com (2603:1096:101:2cb::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.496.5 via Frontend Transport; Wed, 14 Oct 2026 04:50:38 +0000

from TYDPR03CU002.outbound.protection.outlook.com (2a01:111:f403:c405::7) by OSA0EPF000000CD.mail.protection.outlook.com (2603:1096:608::3b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Wed, 14 Oct 2026 04:50:33 +0000

from PSAPR02MB5224.apcprd02.prod.outlook.com (2603:1096:301:7b::11) by KL1PR02MB7285.apcprd02.prod.outlook.com (2603:1096:820:120::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Wed, 14 Oct 2026 04:50:26 +0000

from PSAPR02MB5224.apcprd02.prod.outlook.com ([fe80::b7d1:2332:aadd:169e]) by PSAPR02MB5224.apcprd02.prod.outlook.com ([fe80::b7d1:2332:aadd:169e%3]) with mapi id 15.21.0522.012; Wed, 14 Oct 2026 04:50:26 +0000

Received-Spf

Pass (protection.outlook.com: domain of euholidays.com.sg designates 2a01:111:f403:c405::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c405::7; helo=TYDPR03CU002.outbound.protection.outlook.com; pr=C

Message-Id

<PSAPR02MB52244F24251904F4C1D14A64ED9D2@PSAPR02MB5224.apcprd02.prod.outlook.com>

Extracted URLs

  • file http://www.euholidays.com.sg

  • file http://www.euholidays.com.sg/