Windows Analysis Report
FW_ Orderbevestiging - 85500000571-1.msg

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

• Found application associated with file extension: .msg

{
    "explanation": [
        "The email claims to be from Dustin B.V. but is being forwarded through internal company addresses, which is unusual for order confirmations",
        "Generic and vague message body with minimal details about the order",
        "Contains a PDF attachment with a suspicious naming pattern that could contain malware"
    ],
    "phishing": true,
    "confidence": 8
}

{
    "date": "Wed, 30 Oct 2024 13:29:20 +0100", 
    "subject": "FW: Orderbevestiging - 85500000571-1", 
    "communications": [
        " \n\n \n\nVriendelijke groeten, Cordialement, mit freundlichen Gren, Best regards, S pozdravom,\n\n \n\n\n\nElke van den Bergh\n\nAccounting Department\n\nThermo-Clean Group\n\nTel: +32 13 53 90 18\n\nwww.thermoclean.com <http://www.thermoclean.com> \n\n <https://www.youtube.com/@thermo-cleangroup5215>      <https://nl.linkedin.com/company/thermo-clean/>      <https://www.facebook.com/thermoclean/> \n\n \n\nIn light of the European GDPR, we inform you that your personal data is stored in our system and is only used for processing your orders and maintaining our business relationship. If you wish to learn more about our data management and protection policy, please check our Privacy Statement at  www.thermoclean.com/en/about-us/privacy-declaration <http://www.thermoclean.com/en/about-us/privacy-declaration>  .\n\n \n\n \n\n \n\n", 
        "From: Dustin B.V. <noreply@dustin.com> \nSent: woensdag 30 oktober 2024 13:04\nTo: Invoices <invoices@thermoclean.com>\nSubject: Orderbevestiging - 85500000571-1\n\n \n\nExternal Email \n\nThis email was sent from outside the Thermo-Clean organization.\n\nDear,\n\nSee attached the order confirmation document.\n\nDustin\n\n"
    ], 
    "from": "Invoices <invoices@thermoclean.com>", 
    "to": "IT Support <it.support@thermoclean.com>", 
    "attachements": [
        "85500000571-1.pdf", 
        "image001.png", 
        "image002.jpg", 
        "image003.jpg", 
        "image004.jpg"
    ]
}

```json
{
  "contains_trigger_text": true,
  "trigger_text": "Orderbevestiging",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Klantnummer",
    "Ordernummer",
    "Uw referentie",
    "Datum",
    "MPN",
    "Stijl",
    "Omschrijving",
    "Aantal",
    "Stukprijs",
    "Prijs"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "contains_trigger_text": true,
  "trigger_text": "See attached the order confirmation document.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Invoices <invoices@thermoclean.com>"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    "THERMO",
    "CLEAN"
  ]
}

```json
{
  "brands": [
    "Dustin"
  ]
}