PDF Lure - Distribution Settlement Agreement with Lorem Ipsum Thread

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.