Overview

overview

3

Static

static

3

Potential ...B).msg

windows10-2004-x64

3

Potential ...B).msg

windows11-ltsc_2024-x64

1

Nishiara L...rt.pdf

windows10-2004-x64

3

Nishiara L...rt.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Potential Phish (72.6 KB).msg
  • Size 105KB
  • Sample261027-rca32aev5q
  • SHA256 ece1c2e31ef081f30a6e45c6a6ea2b6b907f8b364bfbc9a97d43dc5eda9065d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

File Explorer

  • Potential Phish (72.6 KB).msg
    .msg .pdf 105KB
  • Nishiara Legister-short.pdf
    .pdf 54KB

Potential Phish (72.6 KB).msg

  • SHA256 ece1c2e31ef081f30a6e45c6a6ea2b6b907f8b364bfbc9a97d43dc5eda9065d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
polyglot

Email Headers

Return-Path

[email protected]

Date

Sat, 24 Oct 2026 06:25:38 -0400

Subject

Openings

Content-Type

multipart/mixed; boundary="===============3219771236240964845=="

Received

from CO6PR04MB7777.namprd04.prod.outlook.com (2603:10b6:5:354::5) by BN8PR04MB6081.namprd04.prod.outlook.com with HTTPS; Sat, 24 Oct 2026 10:25:59 +0000

from SJ0PR05CA0021.namprd05.prod.outlook.com (2603:10b6:a03:33b::26) by CO6PR04MB7777.namprd04.prod.outlook.com (2603:10b6:5:354::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.21; Sat, 24 Oct 2026 10:25:55 +0000

from MWH0EPF000C6187.namprd02.prod.outlook.com (2603:10b6:a03:33b:cafe::b) by SJ0PR05CA0021.outlook.office365.com (2603:10b6:a03:33b::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Sat, 24 Oct 2026 10:25:54 +0000

from mx0a-00332601.pphosted.com (148.163.133.252) by MWH0EPF000C6187.mail.protection.outlook.com (10.167.249.119) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Sat, 24 Oct 2026 10:25:54 +0000

from pps.filterd (m0280862.ppops.net [127.0.0.1]) by mx0a-00332601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69OALNGW2368533 for <[email protected]>; Sat, 24 Oct 2026 10:25:53 GMT

from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) by mx0a-00332601.pphosted.com (PPS) with ESMTPS id 4hgktf0cgs-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for <[email protected]>; Sat, 24 Oct 2026 10:25:52 +0000 (GMT)

by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-c38ac26cc5dso240270166b.2 for <[email protected]>; Sat, 24 Oct 2026 03:25:52 -0700 (PDT)

X-Received

by 2002:a17:907:7fa2:b0:c34:e9fe:82ed with SMTP id a640c23a62f3a-c46bde53641mr175054866b.28.1792837550843; Sat, 24 Oct 2026 03:25:50 -0700 (PDT)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 148.163.133.252 as permitted sender)

Message-Id

<CAKeb_smoPj=19e_dVnxzfwyinDj8D2L3Y+H+ZGRc1ySd+[email protected]>