General

  • Target
    Email recebido (fraude).eml
  • Size 89KB
  • Sample260727-k64twazbpc
  • SHA256 7a8b2e0b252310a278764927df923b2d8813a875b915c02d2e244237dda2abac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • Email recebido (fraude).eml
    .eml 89KB
  • Reservation #6657453112, quarta-feira, 12 de agosto de 2026.pdf
    .pdf 24KB
  • email-html-1.txt
    .html 12KB

Email recebido (fraude).eml

  • SHA256 7a8b2e0b252310a278764927df923b2d8813a875b915c02d2e244237dda2abac
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

0100019f99c7efa9-5a350d5a-08c1-4553-bb62-217e8a50c377-000000@email.amazonses.com

Return-Path

alertaseguranca+[email protected]

Date

Mon, 27 Jul 2026 09:45:30 +0100

Subject

Email recebido (fraude)

Content-Type

multipart/mixed; boundary="--_com.android.email_8912189921658400"

Received

from MRWPR03MB11227.eurprd03.prod.outlook.com (2603:10a6:501:9b::7) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Mon, 27 Jul 2026 08:47:29 +0000

from DB9PR06CA0024.eurprd06.prod.outlook.com (2603:10a6:10:1db::29) by MRWPR03MB11227.eurprd03.prod.outlook.com (2603:10a6:501:9b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Mon, 27 Jul 2026 08:47:24 +0000

from DB5PEPF00014B9B.eurprd02.prod.outlook.com (2603:10a6:10:1db:cafe::84) by DB9PR06CA0024.outlook.office365.com (2603:10a6:10:1db::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Mon, 27 Jul 2026 08:47:24 +0000

from nat.eu.perception-point.io (99.80.189.20) by DB5PEPF00014B9B.mail.protection.outlook.com (10.167.8.168) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Mon, 27 Jul 2026 08:47:24 +0000

from DB3PR08CU002.outbound.protection.outlook.com (mail-db3pr08cu00202.outbound.protection.outlook.com [40.93.64.82]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id nhu5hjse8b4on9cjo9u0n6fllp7upgeb19qe9mg1 for [email protected]; Mon, 27 Jul 2026 08:47:18 +0000 (UTC)

from AS4P195CA0024.EURP195.PROD.OUTLOOK.COM (2603:10a6:20b:5d6::11) by DU2PR03MB10093.eurprd03.prod.outlook.com (2603:10a6:10:49e::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul 2026 08:45:42 +0000

from AM1PEPF000252DC.eurprd07.prod.outlook.com (2603:10a6:20b:5d6:cafe::2a) by AS4P195CA0024.outlook.office365.com (2603:10a6:20b:5d6::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Mon, 27 Jul 2026 08:45:42 +0000

from AM0PR83CU005.outbound.protection.outlook.com (2a01:111:f403:c201::1) by AM1PEPF000252DC.mail.protection.outlook.com (2603:10a6:20f:fff4:0:3:0:6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Mon, 27 Jul 2026 08:45:41 +0000

from DUZP191CA0058.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4fa::18) by FRWPR10MB9209.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:d10:19c::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul 2026 08:45:36 +0000

from DB1PEPF000509FE.eurprd03.prod.outlook.com (2603:10a6:10:4fa:cafe::23) by DUZP191CA0058.outlook.office365.com (2603:10a6:10:4fa::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.13 via Frontend Transport; Mon, 27 Jul 2026 08:45:36 +0000

from DB3PR0202CU003.outbound.protection.outlook.com (2a01:111:f403:d200::) by DB1PEPF000509FE.mail.protection.outlook.com (2603:10a6:18:3::6d8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Mon, 27 Jul 2026 08:45:36 +0000

from PA3PR10MB9229.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:4af::20) by DU0PR10MB7285.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:447::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul 2026 08:45:34 +0000

from PA3PR10MB9229.EURPRD10.PROD.OUTLOOK.COM ([fe80::5363:77df:ef38:4efa]) by PA3PR10MB9229.EURPRD10.PROD.OUTLOOK.COM ([fe80::5363:77df:ef38:4efa%3]) with mapi id 15.21.0245.009; Mon, 27 Jul 2026 08:45:34 +0000

Received-Spf

Fail (protection.outlook.com: domain of wizink.pt does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink.pt designates 40.93.64.82 as permitted sender) client-ip=40.93.64.82; envelope-from=alertaseguranca+[email protected]; helo=DB3PR08CU002.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink.pt designates 2a01:111:f403:c201::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::1; helo=AM0PR83CU005.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of hotmail.com designates 2a01:111:f403:d200:: as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:d200::; helo=DB3PR0202CU003.outbound.protection.outlook.com; pr=C

Message-Id

<PA3PR10MB922910DDEFC4ACC49B51C08BE9CC2@PA3PR10MB9229.EURPRD10.PROD.OUTLOOK.COM>

Extracted URLs

  • file https://link.y3i3s35.dalianshebei.com/CL0/https:%2F%2Freserve.dalianshebei.com%2Fpt%2FysWuDIt7ootB9po1%2F6657453112/1/0100019f99c7efa9-5a350d5a-08c1-4553-bb62-217e8a50c377-000000/McjQiuyLOQO0uf2ZqNSiCMUCypjrfbbQw42pdrRfJl0=452

  • file https://link.y3i3s35.dalianshebei.com/CL0/https:%2F%2Freserve.dalianshebei.com%2Fpt%2FysWuDIt7ootB9po1%2F6657453112/2/0100019f99c7efa9-5a350d5a-08c1-4553-bb62-217e8a50c377-000000/tyKTZoYZkA5-lzAg_q9z1QOexCeUwqTKX8lj1FqGEVo=452