Faturação Vodafone_ Seu pagamento não pôde ser processado[.][.]eml

General

Target
Faturação Vodafone_ Seu pagamento não pôde ser processado..eml
Size 52KB
Sample260804-gl43csdh88
SHA256 c70dbabad800998702d22463a949aea1a765bc4a9b2ac10e3c571f03f4d5e812
MD5 ceaac3f4784c81bf6f18b5ed07c29a40
SHA1 752bab967d1c6a8c59bbf2494ddbf789b32ed68e
SHA512 e45849523b5d70f3f799f555c2f49dc31b644b303c9646dd64e2bd5a42632f2c1c3d7d8723c85c16c0e1ce97e85536e4978892e62ccbbe71def38d441253db3d
SSDEEP 1536:pbr1GZdh4BCzUbJHaq0JhXWLvGSQzYtTA:pbQh4QzUl6qwXWLWsA
TLSH
T16B334B5543861C8A8AB311A4A812BE4CE3D0780EA53695F0B46FB6375FCF0172F6F69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Faturação Vodafone_ Seu pagamento não pôde ser processado..eml

.eml 52KB
email-html-1.txt

.html 21KB

Faturação Vodafone_ Seu pagamento não pôde ser processado..eml

SHA256 c70dbabad800998702d22463a949aea1a765bc4a9b2ac10e3c571f03f4d5e812
MD5 ceaac3f4784c81bf6f18b5ed07c29a40
SHA1 752bab967d1c6a8c59bbf2494ddbf789b32ed68e
SHA512 e45849523b5d70f3f799f555c2f49dc31b644b303c9646dd64e2bd5a42632f2c1c3d7d8723c85c16c0e1ce97e85536e4978892e62ccbbe71def38d441253db3d
SSDEEP 1536:pbr1GZdh4BCzUbJHaq0JhXWLvGSQzYtTA:pbQh4QzUl6qwXWLWsA
TLSH
T16B334B5543861C8A8AB311A4A812BE4CE3D0780EA53695F0B46FB6375FCF0172F6F69D
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

alertaseguranca+[email protected]

Date

4 Aug 2026 01:38:50 -0000

Subject

=?UTF-8?B?RmF0dXJhw6fDo28gVm9kYWZvbmU6IFNldSBwYWdhbWVudG8gbsOjbyBww7RkZSBzZXIgcHJvY2Vzc2Fkby4=?=

Content-Type

text/html; charset=UTF-8

Received

from GVXPR03MB10849.eurprd03.prod.outlook.com (2603:10a6:150:21f::20) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Tue, 4 Aug 2026 01:39:51 +0000

from AS4PR10CA0025.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:5d8::14) by GVXPR03MB10849.eurprd03.prod.outlook.com (2603:10a6:150:21f::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.17; Tue, 4 Aug 2026 01:39:28 +0000

from AM4PEPF00025F9C.EURPRD83.prod.outlook.com (2603:10a6:20b:5d8:cafe::40) by AS4PR10CA0025.outlook.office365.com (2603:10a6:20b:5d8::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.18 via Frontend Transport; Tue, 4 Aug 2026 01:39:28 +0000

from nat.eu.perception-point.io (99.80.189.20) by AM4PEPF00025F9C.mail.protection.outlook.com (10.167.16.11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.315.0 via Frontend Transport; Tue, 4 Aug 2026 01:39:28 +0000

from GV1PR07CU001.outbound.protection.outlook.com (mail-gv1pr07cu00105.outbound.protection.outlook.com [40.93.214.101]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id r8sl2bo4cvuiup8dsem8udiqq4o97ljhhlsehlg1 for [email protected]; Tue, 04 Aug 2026 01:39:23 +0000 (UTC)

from DU6P191CA0009.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:540::9) by VI0PR03MB11138.eurprd03.prod.outlook.com (2603:10a6:800:2d0::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.17; Tue, 4 Aug 2026 01:39:02 +0000

from DB1PEPF000509E9.eurprd03.prod.outlook.com (2603:10a6:10:540:cafe::56) by DU6P191CA0009.outlook.office365.com (2603:10a6:10:540::9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.18 via Frontend Transport; Tue, 4 Aug 2026 01:39:02 +0000

from AM0PR02CU008.outbound.protection.outlook.com (2a01:111:f403:c201::6) by DB1PEPF000509E9.mail.protection.outlook.com (2603:10a6:18:3::61b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Tue, 4 Aug 2026 01:39:01 +0000

from DUZPR01CA0352.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b8::15) by GV1PR10MB8846.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:1d7::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.18; Tue, 4 Aug 2026 01:38:54 +0000

from DU6PEPF0000B620.eurprd02.prod.outlook.com (2603:10a6:10:4b8:cafe::37) by DUZPR01CA0352.outlook.office365.com (2603:10a6:10:4b8::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.15 via Frontend Transport; Tue, 4 Aug 2026 01:38:54 +0000

from ns208.webmasters.com (51.81.131.128) by DU6PEPF0000B620.mail.protection.outlook.com (10.167.8.136) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Tue, 4 Aug 2026 01:38:53 +0000

(qmail 1459 invoked by uid 2526); 4 Aug 2026 01:38:50 -0000

Received-Spf

Fail (protection.outlook.com: domain of wizink.pt does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink.pt designates 40.93.214.101 as permitted sender) client-ip=40.93.214.101; envelope-from=alertaseguranca+[email protected]; helo=GV1PR07CU001.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink.pt designates 2a01:111:f403:c201::6 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::6; helo=AM0PR02CU008.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of ns208.webmasters.com designates 51.81.131.128 as permitted sender) receiver=protection.outlook.com; client-ip=51.81.131.128; helo=ns208.webmasters.com; pr=C

X-Mailer

PHP/7.3.31-1~deb10u1

Message-Id

<[email protected]>

Sharing