General

  • Target
    129027901.eml
  • Size 122KB
  • Sample260924-lpbmfaaf78
  • SHA256 bc6fd313c78524627853c604b832f912f8fbd4f475ffbe41dff5989695a19923
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 129027901.eml
    .eml 122KB
  • WiZink Prevenção Fraude - Bloqueio.pdf
    .pdf 43KB
  • email-html-2.txt
    .html 19KB
  • email-plain-1.txt
    4KB

129027901.eml

  • SHA256 bc6fd313c78524627853c604b832f912f8fbd4f475ffbe41dff5989695a19923
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

[email protected]

Return-Path

alertaseguranca+[email protected]

Date

Thu, 24 Sep 2026 09:30:21 +0000

Subject

129027901

Content-Type

multipart/mixed; boundary="_004_DU7PR03MB10993D6D4E158179636CB6C8597812DU7PR03MB10993eu_"

Received

from DB9PR03MB8169.eurprd03.prod.outlook.com (2603:10a6:10:373::21) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Thu, 24 Sep 2026 09:33:11 +0000

from DU2PR04CA0225.eurprd04.prod.outlook.com (2603:10a6:10:2b1::20) by DB9PR03MB8169.eurprd03.prod.outlook.com (2603:10a6:10:373::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:33:05 +0000

from DU2PEPF00028D08.eurprd03.prod.outlook.com (2603:10a6:10:2b1:cafe::e) by DU2PR04CA0225.outlook.office365.com (2603:10a6:10:2b1::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Thu, 24 Sep 2026 09:33:05 +0000

from nat.eu.perception-point.io (99.80.189.20) by DU2PEPF00028D08.mail.protection.outlook.com (10.167.242.168) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 09:33:05 +0000

from GV1PR07CU001.outbound.protection.outlook.com (mail-gv1pr07cu00103.outbound.protection.outlook.com [40.93.214.99]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id rtkal2erd2qo5uup8m48sd2jhdlfdat2d3e4osg1 for [email protected]; Thu, 24 Sep 2026 09:33:00 +0000 (UTC)

from PR3P192CA0025.EURP192.PROD.OUTLOOK.COM (2603:10a6:102:56::30) by DU5PR03MB10442.eurprd03.prod.outlook.com (2603:10a6:10:527::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:30:31 +0000

from MI3PEPF00008553.eurprd05.prod.outlook.com (2603:10a6:102:56:cafe::5d) by PR3P192CA0025.outlook.office365.com (2603:10a6:102:56::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.14 via Frontend Transport; Thu, 24 Sep 2026 09:30:30 +0000

from AM0PR02CU008.outbound.protection.outlook.com (2a01:111:f403:c201::6) by MI3PEPF00008553.mail.protection.outlook.com (2603:10a6:298:1::87) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 09:30:30 +0000

from DU7PR01CA0010.eurprd01.prod.exchangelabs.com (2603:10a6:10:50f::23) by PAXPR10MB5229.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:276::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:30:25 +0000

from DU2PEPF00028D0B.eurprd03.prod.outlook.com (2603:10a6:10:50f:cafe::4e) by DU7PR01CA0010.outlook.office365.com (2603:10a6:10:50f::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Thu, 24 Sep 2026 09:30:25 +0000

from MRWPR03CU001.outbound.protection.outlook.com (2a01:111:f403:d207::1) by DU2PEPF00028D0B.mail.protection.outlook.com (2603:10a6:18:3::6ab) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 09:30:24 +0000

from DU7PR03MB10993.eurprd03.prod.outlook.com (2603:10a6:10:5b0::18) by DB9PR03MB7307.eurprd03.prod.outlook.com (2603:10a6:10:22b::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 09:30:21 +0000

from DU7PR03MB10993.eurprd03.prod.outlook.com ([fe80::bc1a:7222:812a:5a01]) by DU7PR03MB10993.eurprd03.prod.outlook.com ([fe80::bc1a:7222:812a:5a01%4]) with mapi id 15.21.0451.014; Thu, 24 Sep 2026 09:30:21 +0000

Received-Spf

Fail (protection.outlook.com: domain of wizink.pt does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink.pt designates 40.93.214.99 as permitted sender) client-ip=40.93.214.99; envelope-from=alertaseguranca+[email protected]; helo=GV1PR07CU001.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink.pt designates 2a01:111:f403:c201::6 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c201::6; helo=AM0PR02CU008.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of netcabo.pt designates 2a01:111:f403:d207::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:d207::1; helo=MRWPR03CU001.outbound.protection.outlook.com; pr=C

Message-Id

<DU7PR03MB10993D6D4E158179636CB6C8597812@DU7PR03MB10993.eurprd03.prod.outlook.com>

Extracted URLs

  • file https://email.alertas.wizink.pt/c/eJxEks1uozAQgJ8Gbo3sMXGSA4emhDZRQ1tiIOGy8l8KG8AWmKT06VfparW3-UYz0jc_KiQYnwH7OsSLFQJCl0D9KgxgteQBJ1rQ5QJjyhWHFT_PqeYScY78OgQEFK0gQEuEgM70IlgIEmgccHGmK-EFiDe6d3yY3ervurvMrPObsHLODh559CD2IL7dbrPJjG4UeiZNe8_81FrTu_GTNx6Jdcs9EmEMCLBHHqV9kLx3fJTyTv3D38CIh7o7m77lrr5qvw9550xXm1-Wj40ZvAB12kkuzN1iqHsjpfnpCL3F2gOolQfwowWC7HYcvlgSVV222a1PXTznl7TLGnV8Y9tJkJIecB6ITFGZ2aEsUpuCtZw1TUqq57c8bossbtOorA6xxUW3JiJXa_Wy_04vKkrb-QebnBVMYXXJP0rW0LKosrz9mgtIxnKz_Va_E_PBqlfVrMckl7f9i7kWxy1i2WXOjuUkcT5ptjuejs076-LnV3LqeaGu-2c0qdzCobtcS9TAK1iWvDRJ8uSi0zHe6tptcrYmLNrCfvM5iWJY3QeHJw9gMGMv9f89cCerOy0i34V0iQKKie_C90O82ezf4zRC94P8ewP_GsKfAAAA__8JtLms

  • file https://email.alertas.wizink.pt/c/eJxEks9vuzgQxf8auDWyx4SEA4emhDZRQ1tiIOGy8g9YWMC2wElK__oVXa2-t3maedJnZp4MCcY1YLcK8SZAQPwt-G4TrtcBSE_ymiDmewHfVnWNKom5h2ocQO22ISDwUQAe2iIE_qraeBtOvAp7jNd-wB0Psb4aLZtWj_anVd3KWLcPG2vN5JBnB2IH4sfjsepb1VWyVSuhBwdioQfD1Lw0f23LIImrgTkkwhgQYIc8C_Mk2GjZTYhFjU__FZo_tarW48Bse6_cMWTKatXqvwy79XpyPKQqKxjXC8vUjloI_esInc3OAWilA_ALB5wcjwy-aRI1Ktsfd1cVr1mXqqyXlw96mDkp_TPOPZ5JX2RmKovUpGAMo32fkub1I4-HIouHNCqbc2xwoXaE53In304_aSejdFh_0dkaTiWWXf5V0t4viybLh-81h-RW7g8_8p9Ef9HmXfa7W5KLx-lN34vLAdGsW9NLOQuczxU9Xq6X_pOq-PWdXEdWyPvpFc0yN3BW3b1EPbyDoclbnyQvNrpe4kPV2n1Od4RGBzjt_555MQXL4vDiAEz6Norqzx2YFc2iNpFrQ3-LPB8T14af53i_P33GaYSWh_wfBvcewr8BAAD__wJLusE

  • file https://email.alertas.wizink.pt/c/eJxEksFuqzwQhZ8Gdo3sMTFhwaIpoU3U0JYYSNhUxiaFP2Bb4CSlT_-LXl3d3ZzRGembmSNDgvEZsFuH2A8QELoC6jYhD_CK-kFAuaSIIJ_6OPBFHRDwzoLXxG1DQEBRAB5aIQR0UfueXxGvxh6vzjSoHA_xrh4sHxf39qdVl4Wxbhc21prRIY8OxA7E9_t90arR8q-B9wuh-7n36_40draQuO65QyKMAQF2yKMwD4IPll-FmNXw8KfQ1UOrznrouW1vtTuEXFmtWv1p-LXTo-MhVVvBKz1TjO2ghdC_E6Hjrx2AVjoAv1hQkd2OwzdLokZlm936pOIlv6Qq6-TxjW2nipT0gHOvyiQVmRnLIjUpGMNZ16WkeX7L477I4j6NyuYQG1yoNalyuZYv-5_0IqO0X36wyZqKSSwv-UfJOloWTZb338sKkmu52f7I_xL9wZpX2a2vSS7u-xd9K45bxLLLkh3LSeB8qtnueDp270zFz6_kNPBC3vbPaJK5gYO63ErUwSsYlrx0SfJko9Mx3tat3eRsTVi0hf3ma6qKMZgXhycHYNTXQdT_7sCtaGblR64N6Qp5FBPXhu-HeLPZv8dphOaH_I2Bewvh_wAAAP__60i4DA

  • file https://email.alertas.wizink.pt/c/eJxEkstuozAUhp8Gdo3sY3CSBYumhDZRQ1tiIGEz8o2B4WIETtL06Ue0Gs3u_NJ3pO9cVEAwLgG7OsDLNQJCV0DdKvBLVGKthMZYrtaI06XE1Bc-EA9KqolbB4CAojV4aIUQ0IVeektBPI09Lkq6Fo6HeKtHy6fFrf6q-2YxWLcNKmuHySGPDkQORLfbbVFyqYUxzUKazoEor4sfeCZIpDvukBBjQIAd8iiHB8lHyy9Szml8-CmMeKj70owdt_VVu2PAe2v62vwa-KU1k-OhXlvJhZklpno0UprvjsBZbhyAWjkA31YgyH7P4ZPFYdWn2_3m3Ec-b5I-bdXpje3ughT0iDNPpIrKdJiKPBkSGAbO2jYh1fNbFnV5GnVJWFTHaMB5vyEiUxv1cvhKGhUmnf_B7nYQTGHVZB8Fa2mRV2nWffoC4kux3X2pP7H5YNWrajeXOJO3w4u55qcdYmnjs1Nxlzi7a7Y_nU_tO-uj51dyHnmurodndFfZAMe-uRaohVcYWPzSxvGTDc-naKdru83YhrBwB4ft77vIp_U8ODw5AJO5jFL_3wO3sprTMnRtQFfIo5i4Nng_Rtvt4T1KQjQf5N8XuNcA_gYAAP__D2K3gw