1477 east Shaw[.]msg

General

Target
1477 east Shaw.msg
Size 169KB
Sample261104-xrx41aee33
SHA256 78049dad20f9bf9a2443627ffd2d7e282a4932f4a9073d3856e99e069fcc2ee9
MD5 1318c5482f6ffb1be713809b88ff2b72
SHA1 c348e31d3b68736f0518df2343e3ad4d04d83fa3
SHA512 30ee50b91baf3f1319ee141c4ad22fd3bb78398b7a0f1da4b329172c796b4a5a5fc76ea51425a2fdfc2e0c84caea48404600f49729ccc267d95a84056b5183f3
SSDEEP 3072:lCN6kD3qqr8uW64wV4WTCaCS14Ul2nrfmQqpXeVKmS2RHGHZ9:lCN6EqZH6/V4mCjS2U2n5NVKgEZ9
TLSH
T188045D2539FB4109F1779F364FE2A0A7853AFD927E15959F2091334E0672940ECA2B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

pdf evasion

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

File Explorer

1477 east Shaw.msg

.msg 169KB
Business Tax 03-31-2027.pdf

.pdf 98KB

1477 east Shaw.msg

SHA256 78049dad20f9bf9a2443627ffd2d7e282a4932f4a9073d3856e99e069fcc2ee9
MD5 1318c5482f6ffb1be713809b88ff2b72
SHA1 c348e31d3b68736f0518df2343e3ad4d04d83fa3
SHA512 30ee50b91baf3f1319ee141c4ad22fd3bb78398b7a0f1da4b329172c796b4a5a5fc76ea51425a2fdfc2e0c84caea48404600f49729ccc267d95a84056b5183f3
SSDEEP 3072:lCN6kD3qqr8uW64wV4WTCaCS14Ul2nrfmQqpXeVKmS2RHGHZ9:lCN6EqZH6/V4mCjS2U2n5NVKgEZ9
TLSH
T188045D2539FB4109F1779F364FE2A0A7853AFD927E15959F2091334E0672940ECA2B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Date

Wed, 4 Nov 2026 11:02:21 -0800

Subject

1477 east Shaw

Content-Type

multipart/alternative; boundary="Apple-Mail-2137D7B8-B4DC-4A6F-8B43-C0EE86123A25"

Received

from qs-2005h-snip4-11.eps.apple.com (HELO outbound.qs.icloud.com) ([57.103.86.211]) by esa3.hc4447-47.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2026 00:02:27 +0500

from outbound.qs.icloud.com (unknown [127.0.0.2]) by p00-icloudmta-asmtp-us-east-2d-20-percent-2 (Postfix) with ESMTPS id 71D841870BA0; Wed, 04 Nov 2026 19:02:24 +0000 (UTC)

from smtpclient.apple (unknown [17.57.155.37]) by p00-icloudmta-asmtp-us-east-2d-20-percent-2 (Postfix) with ESMTPSA id 250AF18012C7; Wed, 04 Nov 2026 19:02:23 +0000 (UTC)

Received-Spf

Pass (esa.hc4447-47.iphmx.com: domain of [email protected] designates 57.103.86.211 as permitted sender) identity=mailfrom; client-ip=57.103.86.211; receiver=esa.hc4447-47.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:57.103.64.0/18 ip6:2a01:b747:3000:200::/56 ip6:2a01:b747:3001:200::/56 ip6:2a01:b747:3002:200::/56 ip6:2a01:b747:3003:200::/56 ip6:2a01:b747:3004:200::/56 ip6:2a01:b747:3005:200::/56 ip6:2a01:b747:3006:200::/56 ip6:2a01:b747:3007::/56"

X-Mailer

iPhone Mail (23G83)

Message-Id

<[email protected]>

Extracted URLs

file http://www.highwaygrinding.com
file https://dl.dropboxusercontent.com/s/6hq0vwousa84eq1/IMG_7609.jpeg?dl=0
file https://www.diamondproducts.com/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/p/c/pc6004.jpg

Sharing