General

  • Target
    Informacion de impuesto de industria y comercio periodo 2025.msg
  • Size 76KB
  • Sample260910-tbx8aadf62
  • SHA256 69ab7ab815add4bf63f5fa11803e18ed0138497bb38db8911372c8e443a53739
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Informacion de impuesto de industria y comercio periodo 2025.msg
    .msg 76KB

Informacion de impuesto de industria y comercio periodo 2025.msg

  • SHA256 69ab7ab815add4bf63f5fa11803e18ed0138497bb38db8911372c8e443a53739
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Thu, 10 Sep 2026 14:37:36 +0000

Subject

=?utf-8?B?SW5mb3JtYWNpb24gZGUgaW1wdWVzdG8gZGUgaW5kdXN0cmlhIHkgY29tZXJj?= =?utf-8?B?aW8g4oCTIHBlcmlvZG8gMjAyNQ==?=

Content-Type

multipart/alternative; boundary="_000_CAH8qJjfWf2ukKog6kpTPMYQEMxHR82jkrzDxVLq4m0juZQmailgmai_"

Received

from DM6PR15MB4072.namprd15.prod.outlook.com (2603:10b6:5:2bf::16) by PH0PR15MB5165.namprd15.prod.outlook.com with HTTPS; Thu, 10 Sep 2026 14:38:15 +0000

from SN7PR04CA0077.namprd04.prod.outlook.com (2603:10b6:806:121::22) by DM6PR15MB4072.namprd15.prod.outlook.com (2603:10b6:5:2bf::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.9; Thu, 10 Sep 2026 14:38:05 +0000

from SA2PEPF00003F68.namprd04.prod.outlook.com (2603:10b6:806:121:cafe::5a) by SN7PR04CA0077.outlook.office365.com (2603:10b6:806:121::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.9 via Frontend Transport; Thu, 10 Sep 2026 14:38:05 +0000

from papiro.grupoasd.com.co (204.199.99.30) by SA2PEPF00003F68.mail.protection.outlook.com (10.167.248.43) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Thu, 10 Sep 2026 14:38:04 +0000

from papiro.grupoasd.com.co (localhost.localdomain [127.0.0.1]) by papiro.grupoasd.com.co (Proxmox) with ESMTP id 55B3F6431C0 for <[email protected]>; Thu, 10 Sep 2026 09:38:03 -0500 (-05)

from correo.grupoasd.com.co (correo.grupoasd.cm.co [10.0.5.125]) by papiro.grupoasd.com.co (Proxmox) with ESMTPS id 28629642F9B for <[email protected]>; Thu, 10 Sep 2026 09:38:03 -0500 (-05)

from localhost (localhost [127.0.0.1]) by correo.grupoasd.com.co (Postfix) with ESMTP id 184704403A7 for <[email protected]>; Thu, 10 Sep 2026 09:38:03 -0500 (-05)

from correo.grupoasd.com.co ([127.0.0.1]) by localhost (correo.grupoasd.com.co [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id onqUY3ng2_c8; Thu, 10 Sep 2026 09:38:01 -0500 (-05)

from localhost (localhost [127.0.0.1]) by correo.grupoasd.com.co (Postfix) with ESMTP id B89924405DE; Thu, 10 Sep 2026 09:38:01 -0500 (-05)

from correo.grupoasd.com.co ([127.0.0.1]) by localhost (correo.grupoasd.com.co [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 12Q0yU0RIWMV; Thu, 10 Sep 2026 09:38:01 -0500 (-05)

from papiro.grupoasd.com.co (papiro.grupoasd.com.co [10.0.4.106]) by correo.grupoasd.com.co (Postfix) with ESMTPS id 9C2FB4403A7 for <[email protected]>; Thu, 10 Sep 2026 09:38:01 -0500 (-05)

from papiro.grupoasd.com.co (localhost.localdomain [127.0.0.1]) by papiro.grupoasd.com.co (Proxmox) with ESMTP id 79F806431C0 for <[email protected]>; Thu, 10 Sep 2026 09:38:01 -0500 (-05)

from mail-qv1-f54.google.com (mail-qv1-f54.google.com [209.85.219.54]) by papiro.grupoasd.com.co (Proxmox) with ESMTPS id 26DB6642F9B for <[email protected]>; Thu, 10 Sep 2026 09:37:59 -0500 (-05)

by mail-qv1-f54.google.com with SMTP id 6a1803df08f44-90cc39e06bdso86639226d6.0 for <[email protected]>; Thu, 10 Sep 2026 07:37:58 -0700 (PDT)

Received-Spf

pass (gmail.com ... _spf.google.com: 209.85.219.54 is authorized to use '[email protected]' in 'mfrom' identity (mechanism 'ip4:209.85.128.0/17' matched)) receiver=papiro.grupoasd.com.co; identity=mailfrom; envelope-from="[email protected]"; helo=mail-qv1-f54.google.com; client-ip=209.85.219.54

Message-Id

<CAH8qJjfWf-2ukKog6kpT_PMYQEMxHR82j=kr_zDxVLq4m0juZQ@mail.gmail.com>

Extracted URLs

  • file http://industria_comercio_dian_2025.zip

  • file http://www.dian.gov.co

  • file https://drive-thirdparty.googleusercontent.com/32/type/application/x-zip-compressed

  • file https://drive.google.com/open?id=1Xt0bcIupRzvxJgtf0OdFoUcexnoWpRxI

  • file https://www.dian.gov.co/Prensa/PublishingImages/2024/1110-29062024.jpg

  • file https://www.dian.gov.co/imagenes/Banner-Landing-Renta2024.jpg