General

  • Target
    Contestação transações não autorizadas cartão de crédito.eml
  • Size 2.0MB
  • Sample260720-tcxcdahs2s
  • SHA256 27f7f8bc80bd66138a741839c13166b716f2325f0c025bec1a9c3e71e641a10f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Contestação transações não autorizadas cartão de crédito.eml
    .eml 2.0MB
  • Screenshot_20260720-135829_Chrome.jpg
    .jpg 345KB
  • Screenshot_20260720-135913_Messages.jpg
    .jpg 229KB
  • Screenshot_20260720-143046_Messages.jpg
    .jpg 227KB
  • Screenshot_20260720-143200_Messages.jpg
    .jpg 201KB
  • Screenshot_20260720-144206_Messages.jpg
    .jpg 219KB
  • Screenshot_20260720-161239_Messages.jpg
    .jpg 216KB
  • email-html-2.txt
    .html 3KB
  • email-plain-1.txt
    1KB

Contestação transações não autorizadas cartão de crédito.eml

  • SHA256 27f7f8bc80bd66138a741839c13166b716f2325f0c025bec1a9c3e71e641a10f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

alertaseguranca+[email protected]

Date

Mon, 20 Jul 2026 16:42:49 +0100

Subject

=?UTF-8?B?Q29udGVzdGHDp8OjbyB0cmFuc2HDp8O1ZXMgbsOjbyBhdXRvcml6YWRhcyBjYXJ0w6NvIA==?= =?UTF-8?B?ZGUgY3LDqWRpdG8=?=

Content-Type

multipart/mixed; boundary="000000000000f4e28506570cc2bc"

Received

from DU4PR03MB11178.eurprd03.prod.outlook.com (::1) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Mon, 20 Jul 2026 15:45:11 +0000

from AS4P189CA0004.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5d7::7) by DU4PR03MB11178.eurprd03.prod.outlook.com (2603:10a6:10:61c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 15:45:04 +0000

from AMS0EPF000001A8.eurprd05.prod.outlook.com (2603:10a6:20b:5d7:cafe::5) by AS4P189CA0004.outlook.office365.com (2603:10a6:20b:5d7::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Mon, 20 Jul 2026 15:45:04 +0000

from nat.eu.perception-point.io (99.80.189.20) by AMS0EPF000001A8.mail.protection.outlook.com (10.167.16.148) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Mon, 20 Jul 2026 15:45:03 +0000

from DB6PR07CU003.outbound.protection.outlook.com (mail-db6pr07cu00300.outbound.protection.outlook.com [40.93.64.88]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id 07fq6ct0vdraqbkrjrhb6tp8kd1e3rgmjhuurko1 for [email protected]; Mon, 20 Jul 2026 15:44:53 +0000 (UTC)

from AS9PR04CA0158.eurprd04.prod.outlook.com (2603:10a6:20b:530::6) by AS2PR03MB8906.eurprd03.prod.outlook.com (2603:10a6:20b:5f1::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 15:43:18 +0000

from AMS1EPF0000008F.eurprd05.prod.outlook.com (2603:10a6:20b:530:cafe::4f) by AS9PR04CA0158.outlook.office365.com (2603:10a6:20b:530::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Mon, 20 Jul 2026 15:43:18 +0000

from GVXPR05CU001.outbound.protection.outlook.com (2a01:111:f403:c202::7) by AMS1EPF0000008F.mail.protection.outlook.com (2603:10a6:20f:fff8::226) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Mon, 20 Jul 2026 15:43:17 +0000

from DUZPR01CA0324.eurprd01.prod.exchangelabs.com (2603:10a6:10:4ba::29) by PAXPR10MB5360.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:282::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Mon, 20 Jul 2026 15:43:09 +0000

from DB5PEPF00014B92.eurprd02.prod.outlook.com (2603:10a6:10:4ba:cafe::8b) by DUZPR01CA0324.outlook.office365.com (2603:10a6:10:4ba::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Mon, 20 Jul 2026 15:43:09 +0000

from mail-oo1-xc36.google.com (2607:f8b0:4864:20::c36) by DB5PEPF00014B92.mail.protection.outlook.com (2603:10a6:18:3::386) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Mon, 20 Jul 2026 15:43:08 +0000

by mail-oo1-xc36.google.com with SMTP id 006d021491bc7-6a2c1edb210so2661411eaf.3 for <[email protected]>; Mon, 20 Jul 2026 08:43:08 -0700 (PDT)

X-Received

by 2002:a05:6820:2214:b0:6a3:8aab:1214 with SMTP id 006d021491bc7-6a5366ac1b8mr6941271eaf.10.1784562182291; Mon, 20 Jul 2026 08:43:02 -0700 (PDT)

Received-Spf

Fail (protection.outlook.com: domain of wizink.pt does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink.pt designates 40.93.64.88 as permitted sender) client-ip=40.93.64.88; envelope-from=alertaseguranca+[email protected]; helo=DB6PR07CU003.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink.pt designates 2a01:111:f403:c202::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c202::7; helo=GVXPR05CU001.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of gmail.com designates 2607:f8b0:4864:20::c36 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::c36; helo=mail-oo1-xc36.google.com; pr=C

Message-Id

<CAEf9vnLg2Oab1tr4JbbvT5E0J02z51nnDQmc3hGPLsX+[email protected]>

Extracted URLs

  • file https://consultar-envios-ctt.sbs/pt/steps/sms.php

  • file https://consultar-envios-ctt.sbs/pt/steps/sms.php)