Static

static

1

Resubmissions

22/07/2026, 17:23

260722-vx364azeqa

22/07/2026, 17:18

260722-vt8x6shh647

Sharing

Copy URL Twitter E-mail

General

  • Target
    Análisis posible phising.msg
  • Size 107KB
  • Sample260722-vx364azeqa
  • SHA256 08957d92c1b9969a05bbfa996121219eb2991de08cc0988fdfb2eb725c0cef13
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Análisis posible phising.msg
    .msg 107KB
  • Aviso de pago.xlam
    .xlam 6KB

Análisis posible phising.msg

  • SHA256 08957d92c1b9969a05bbfa996121219eb2991de08cc0988fdfb2eb725c0cef13
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

[email protected]

Return-Path

[email protected]

Date

Thu, 2 Jul 2026 11:17:09 -0500

Subject

=?iso-8859-1?Q?An=E1lisis_posible_phising?=

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0001_01DD0A14.53272180"

Received

from SA0PR15MB4063.namprd15.prod.outlook.com (2603:10b6:806:86::23) by BYAPR15MB2485.namprd15.prod.outlook.com with HTTPS; Thu, 2 Jul 2026 16:17:18 +0000

from CH0PR03CA0264.namprd03.prod.outlook.com (2603:10b6:610:e5::29) by SA0PR15MB4063.namprd15.prod.outlook.com (2603:10b6:806:86::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.10; Thu, 2 Jul 2026 16:17:13 +0000

from CH1PEPF0000AD78.namprd04.prod.outlook.com (2603:10b6:610:e5:cafe::31) by CH0PR03CA0264.outlook.office365.com (2603:10b6:610:e5::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.10 via Frontend Transport; Thu, 2 Jul 2026 16:17:13 +0000

from papiro.grupoasd.com.co (204.199.99.30) by CH1PEPF0000AD78.mail.protection.outlook.com (10.167.244.56) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Thu, 2 Jul 2026 16:17:12 +0000

from papiro.grupoasd.com.co (localhost.localdomain [127.0.0.1]) by papiro.grupoasd.com.co (Proxmox) with ESMTP id 8ADEE642BC0; Thu, 2 Jul 2026 11:17:11 -0500 (-05)

from correo.grupoasd.com.co (correo.grupoasd.cm.co [10.0.5.125]) by papiro.grupoasd.com.co (Proxmox) with ESMTPS id 4A3F1642B76; Thu, 2 Jul 2026 11:17:11 -0500 (-05)

from localhost (localhost [127.0.0.1]) by correo.grupoasd.com.co (Postfix) with ESMTP id 2C0194405D5; Thu, 2 Jul 2026 11:17:11 -0500 (-05)

from correo.grupoasd.com.co ([127.0.0.1]) by localhost (correo.grupoasd.com.co [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id pTL2lSaUliTw; Thu, 2 Jul 2026 11:17:10 -0500 (-05)

from localhost (localhost [127.0.0.1]) by correo.grupoasd.com.co (Postfix) with ESMTP id 6C43C4405DE; Thu, 2 Jul 2026 11:17:10 -0500 (-05)

from correo.grupoasd.com.co ([127.0.0.1]) by localhost (correo.grupoasd.com.co [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Cbz3ySLj8WZU; Thu, 2 Jul 2026 11:17:10 -0500 (-05)

from C32CNTAP6037 (unknown [172.27.25.42]) by correo.grupoasd.com.co (Postfix) with ESMTPSA id 272874405D5 for <[email protected]>; Thu, 2 Jul 2026 11:17:10 -0500 (-05)

Received-Spf

Pass (protection.outlook.com: domain of grupoasd.com.co designates 204.199.99.30 as permitted sender) receiver=protection.outlook.com; client-ip=204.199.99.30; helo=papiro.grupoasd.com.co; pr=C

X-Mailer

Microsoft Outlook 16.0

Message-Id

<[email protected]>

Extracted URLs

  • file http://Contabilidad.grupoasd.com.co

  • file http://bbva.com

  • file http://bbva.com.mx

  • file http://grupoasd.com.co

  • file http://zh-klvpn.com

  • file https://lh7-qw.googleusercontent.com/docsz/AD_4nXepYGCHwnuTXiFRM9UPRQQsF82rLXrHXC5H-1-PlXW5YsQ1z9At5AIccrzYhFza9nco9GxBBWhajHqHrZiv47epzjZIuZfB1gALEFTBcWiO-wIlSgvXuwF-HlXEyY2b-pyX0KYgDA?key=YIw501FvLlINQ9TMUmUvVQ