Overview

overview

10

Static

static

1

RV NRO. 15... -.msg

windows10-2004-x64

3

RV NRO. 15... -.msg

windows11-ltsc_2024-x64

1

Re comprob....xhtml

windows10-2004-x64

10

Re comprob....xhtml

windows11-ltsc_2024-x64

3

image001.png

windows10-2004-x64

1

image001.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg
  • Size 7.5MB
  • Sample260923-rybxfswt6p
  • SHA256 d45fdd82b77069225a3b02a8ae0975eb4e8f18c2943614bae304f608075e6ce7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg
    .msg 7.5MB
  • Re comprobante.duplicado.Tutela-Cierre-Decomiso.xhtml
    7.4MB
  • image001.png
    .png 6KB

RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg

  • SHA256 d45fdd82b77069225a3b02a8ae0975eb4e8f18c2943614bae304f608075e6ce7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

SJ0PR01MB63993B59C336B8EC86C64A37E0B82@SJ0PR01MB6399.prod.exchangelabs.com

Return-Path

[email protected]

Date

Thu, 17 Sep 2026 19:11:52 +0000

Subject

RV: NRO. 15001505100320196799680 | DESARCHIVO | DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -

Content-Type

application/ms-tnef; name="winmail.dat"

Received

from PH9PR01MB265993.prod.exchangelabs.com (::1) by SAWPR01MB994597.prod.exchangelabs.com with HTTPS; Thu, 17 Sep 2026 19:12:13 +0000

from PH7PR01MB7799.prod.exchangelabs.com (2603:10b6:510:1da::7) by PH9PR01MB265993.prod.exchangelabs.com (2603:10b6:510:42d::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.12; Thu, 17 Sep 2026 19:11:53 +0000

from PH7PR01MB7799.prod.exchangelabs.com ([fe80::aa0c:d99b:953f:2481]) by PH7PR01MB7799.prod.exchangelabs.com ([fe80::aa0c:d99b:953f:2481%4]) with mapi id 15.21.0406.007; Thu, 17 Sep 2026 19:11:53 +0000

Message-Id

<PH7PR01MB77991CF184CDD0BD19A2511EF0B82@PH7PR01MB7799.prod.exchangelabs.com>

Extracted URLs

  • file http://masboleteria.com

  • file http://rbm.com.co

  • file http://www.masboleteria.com

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://www.masboleteria.com