Até quando vai continuar a suportar as dores nos joelhos_[.]eml

General

Target
Até quando vai continuar a suportar as dores nos joelhos_.eml
Size 173KB
Sample260729-rwpershh45
SHA256 55368ce7b7bb89a5b170f1bf19b3be8dc88f0d9182de5467f0c71cb7ad72c170
MD5 5de513f78e30d2f0c208809191396df2
SHA1 a99c372be903aec91fb1b1ef6a2f6dc22cb12db6
SHA512 c73ad3650810bb90e3d9a318405c77d2780be23d6633cbf54fe8e4a45942ad786382909a3ed04d58d310a9f70e0d56cd4c5416cb24b394e1b85da0e1dff0c18e
SSDEEP 3072:75CtEtHPiA2ftNyUHulOJg2ZT/F80brUyNA5ZD15EjyjhmCqPVaSCPPVm:75CtEtHaeWhbF80bXUNj3+7CP9m
TLSH
T16F04F1299FBB0C25C86260D36C10FC0F73906E55B1BBA2D4751A9EF221EE1D8CF5E642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Até quando vai continuar a suportar as dores nos joelhos_.eml

.eml 173KB
email-html-2.txt

.html 2KB
email-plain-1.txt

502B

Até quando vai continuar a suportar as dores nos joelhos_.eml

SHA256 55368ce7b7bb89a5b170f1bf19b3be8dc88f0d9182de5467f0c71cb7ad72c170
MD5 5de513f78e30d2f0c208809191396df2
SHA1 a99c372be903aec91fb1b1ef6a2f6dc22cb12db6
SHA512 c73ad3650810bb90e3d9a318405c77d2780be23d6633cbf54fe8e4a45942ad786382909a3ed04d58d310a9f70e0d56cd4c5416cb24b394e1b85da0e1dff0c18e
SSDEEP 3072:75CtEtHPiA2ftNyUHulOJg2ZT/F80brUyNA5ZD15EjyjhmCqPVaSCPPVm:75CtEtHaeWhbF80bXUNj3+7CP9m
TLSH
T16F04F1299FBB0C25C86260D36C10FC0F73906E55B1BBA2D4751A9EF221EE1D8CF5E642
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

alertaseguranca+[email protected]

Date

Wed, 29 Jul 2026 15:37:15 +0300

Subject

=?utf-8?B?QXTDqSBxdWFuZG8gdmFpIGNvbnRpbnVhciBhIHN1cG9ydGFyIGFzIGRvcmVzIG5vcyBqb2VsaG9zPw==?=

Content-Type

multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000F_01DD1F6E.013EF630"

Received

from DU2PR03MB9885.eurprd03.prod.outlook.com (2603:10a6:10:499::17) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Wed, 29 Jul 2026 14:29:26 +0000

from AM7PR03CA0026.eurprd03.prod.outlook.com (2603:10a6:20b:130::36) by DU2PR03MB9885.eurprd03.prod.outlook.com (2603:10a6:10:499::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 14:29:19 +0000

from DB1PEPF000509F6.eurprd02.prod.outlook.com (2603:10a6:20b:130:cafe::92) by AM7PR03CA0026.outlook.office365.com (2603:10a6:20b:130::36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Wed, 29 Jul 2026 14:29:19 +0000

from nat.eu.perception-point.io (99.80.189.20) by DB1PEPF000509F6.mail.protection.outlook.com (10.167.242.152) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Wed, 29 Jul 2026 14:29:19 +0000

from DUZPR08CU001.outbound.protection.outlook.com (mail-duzpr08cu00105.outbound.protection.outlook.com [40.93.64.69]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id e4eaqa8a9l8da4l2rljdlibgtg6qt3o3h5if9ig1 for [email protected]; Wed, 29 Jul 2026 14:29:16 +0000 (UTC)

from DUZPR01CA0057.eurprd01.prod.exchangelabs.com (2603:10a6:10:469::6) by AS8PR03MB7924.eurprd03.prod.outlook.com (2603:10a6:20b:427::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 14:29:12 +0000

from DB3PEPF0000885F.eurprd02.prod.outlook.com (2603:10a6:10:469:cafe::2) by DUZPR01CA0057.outlook.office365.com (2603:10a6:10:469::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.13 via Frontend Transport; Wed, 29 Jul 2026 14:29:11 +0000

from DUZPR83CU001.outbound.protection.outlook.com (2a01:111:f403:da00::2) by DB3PEPF0000885F.mail.protection.outlook.com (2603:10a6:18:3::60a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Wed, 29 Jul 2026 14:29:11 +0000

from DUZPR01CA0004.eurprd01.prod.exchangelabs.com (2603:10a6:10:3c3::20) by VI1PR10MB7671.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:1c1::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 14:28:53 +0000

from DB1PEPF000509E8.eurprd03.prod.outlook.com (2603:10a6:10:3c3:cafe::78) by DUZPR01CA0004.outlook.office365.com (2603:10a6:10:3c3::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Wed, 29 Jul 2026 14:28:53 +0000

from mail.maxis-hostel.lol (31.58.85.81) by DB1PEPF000509E8.mail.protection.outlook.com (10.167.242.58) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Wed, 29 Jul 2026 14:28:53 +0000

Received-Spf

Fail (protection.outlook.com: domain of wizink.pt does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink.pt designates 40.93.64.69 as permitted sender) client-ip=40.93.64.69; envelope-from=alertaseguranca+[email protected]; helo=DUZPR08CU001.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink.pt designates 2a01:111:f403:da00::2 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:da00::2; helo=DUZPR83CU001.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of torque-shop.cloud designates 31.58.85.81 as permitted sender) receiver=protection.outlook.com; client-ip=31.58.85.81; helo=mail.maxis-hostel.lol; pr=C

Message-Id

<545016104285211254313377252782744581868760262050@torque-shop.cloud>

Extracted URLs

file https://www.xn--c1arg.xn--b1amjiu8dp.xn--p1acf/MhtXQpL/

Sharing