Overview

overview

3

Static

static

1

Talon pour...02.pdf

windows10-2004-x64

3

Talon pour...02.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Chèques aux fournisseurs.msg
  • Size 149KB
  • Sample261029-vm2waa1vd1
  • SHA256 a9d2fada5cb2a6bdb8cfb9cafc870450193126127000f198d09a88e0f8cbfb41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Chèques aux fournisseurs.msg
    .msg 149KB
  • Talon pour chèque avec talon pour paiement Fournisseur #P0170-0002.pdf
    .pdf 32KB

Chèques aux fournisseurs.msg

  • SHA256 a9d2fada5cb2a6bdb8cfb9cafc870450193126127000f198d09a88e0f8cbfb41
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

29 Oct 2026 10:47:19 -0400

Subject

=?utf-8?B?Q2jDqHF1ZXMgYXV4IGZvdXJuaXNzZXVycw==?=

Content-Type

multipart/mixed; boundary=--boundary_1_226f244f-3df3-485d-80f6-9e8c8c178e4a

Received

from YQXPR01MB5786.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:3b::9) by YT1PR01MB4727.CANPRD01.PROD.OUTLOOK.COM with HTTPS; Thu, 29 Oct 2026 14:47:19 +0000

from YT1PR01CA0057.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2e::26) by YQXPR01MB5786.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:3b::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Thu, 29 Oct 2026 14:47:17 +0000

from YT2PEPF000001CD.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2e:cafe::15) by YT1PR01CA0057.outlook.office365.com (2603:10b6:b01:2e::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.7 via Frontend Transport; Thu, 29 Oct 2026 14:47:17 +0000

from SpamGuard.RedWarning.com (208.72.177.105) by YT2PEPF000001CD.mail.protection.outlook.com (10.167.241.36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Thu, 29 Oct 2026 14:47:16 +0000

from YQZPR01CU011.outbound.protection.outlook.com (mail-canadaeastazon11020088.outbound.protection.outlook.com [52.101.191.88]) by SpamGuard.RedWarning.com with ESMTP id pOjSKR8bJJVWUctb (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for <[email protected]>; Thu, 29 Oct 2026 10:47:15 -0400 (EDT)

from YT3PR01MB680418.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:190::8) by YT2PPFF179E4765.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b08::4a3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Thu, 29 Oct 2026 14:47:10 +0000

from YT3PR01MB680418.CANPRD01.PROD.OUTLOOK.COM ([fe80::6667:8dc3:9034:c868]) by YT3PR01MB680418.CANPRD01.PROD.OUTLOOK.COM ([fe80::6667:8dc3:9034:c868%5]) with mapi id 15.21.0569.008; Thu, 29 Oct 2026 14:47:10 +0000

Received-Spf

Pass (protection.outlook.com: domain of rive-sud.ca designates 52.101.191.88 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.191.88; helo=YQZPR01CU011.outbound.protection.outlook.com; pr=C

Message-Id

<YT3PR01MB680418F245EABEAE5A3F17663D8C6E2@YT3PR01MB680418.CANPRD01.PROD.OUTLOOK.COM>