Overview

overview

4

Static

static

1

Queremos o...o!.msg

windows10-2004-x64

4

Queremos o...o!.msg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    Queremos ouvir sua Opinião!.msg
  • Size 107KB
  • Sample260930-bgnxpavhlh
  • SHA256 e4d34c9d6a73b26bd5836beaba86d668a8e6b424a6a680c19e18d72849e5683c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Queremos ouvir sua Opinião!.msg
    .msg 107KB

Queremos ouvir sua Opinião!.msg

  • SHA256 e4d34c9d6a73b26bd5836beaba86d668a8e6b424a6a680c19e18d72849e5683c
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Tue, 29 Sep 2026 14:33:39 -0300

Subject

=?utf-8?Q?Queremos_ouvir_sua_Opini=C3=A3o!?=

Content-Type

text/html; charset=utf-8

Received

from PA3PR09MB8065.eurprd09.prod.outlook.com (2603:10a6:102:4b4::8) by ZR6PR09MB269025.eurprd09.prod.outlook.com with HTTPS; Tue, 29 Sep 2026 17:56:15 +0000

from DUZPR01CA0206.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b6::21) by PA3PR09MB8065.eurprd09.prod.outlook.com (2603:10a6:102:4b4::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.25; Tue, 29 Sep 2026 17:56:13 +0000

from DB1PEPF000509EB.eurprd03.prod.outlook.com (2603:10a6:10:4b6:cafe::6d) by DUZPR01CA0206.outlook.office365.com (2603:10a6:10:4b6::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 17:56:13 +0000

from webmail.vwgroup.com (194.114.62.25) by DB1PEPF000509EB.mail.protection.outlook.com (10.167.242.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 17:56:13 +0000

from VWAGWOXX0304.vw.vwg (10.186.25.209) by VW2BWOX00E05.vw2c.b2x.vwg (194.114.62.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Tue, 29 Sep 2026 19:56:05 +0200

from VWAGWOXX0811.vw.vwg (10.186.25.63) by VWAGWOXX0304.vw.vwg (10.186.25.209) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Tue, 29 Sep 2026 19:56:05 +0200

from VWAGWOXX0811.vw.vwg (10.186.25.63) by VWAGWOXX0811.vw.vwg (10.186.25.63) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Tue, 29 Sep 2026 19:56:05 +0200

from mailrelay5.vw.com.mx (148.203.161.6) by smtp-wob.vw.vwg (10.186.25.63) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Tue, 29 Sep 2026 19:56:04 +0200

from node210.corporate-mail-br.com ([177.85.215.210]) by mailrelay5i.vw.com.mx with ESMTP; 29 Sep 2026 11:49:18 -0600

by node210.corporate-mail-br.com (Postfix, from userid 1000) id 1F77B8A32E; Tue, 29 Sep 2026 14:33:39 -0300 (-03)

from postfix-consumer-hsrtech-6d75df8466-bxlbf (node6-osc-spo.iagentesmtp.com.br [177.85.209.155]) by node210.corporate-mail-br.com (Postfix) with ESMTP id 18B5D8A262 for <[email protected]>; Tue, 29 Sep 2026 14:33:39 -0300 (-03)

Received-Spf

Pass (protection.outlook.com: domain of cloud3118.pesquisahsr2.com.br designates 177.85.215.210 as permitted sender) receiver=protection.outlook.com; client-ip=177.85.215.210; helo=node210.corporate-mail-br.com; pr=C

Pass (mailrelay5i.vw.com.mx: domain of [email protected] designates 177.85.215.210 as permitted sender) identity=mailfrom; client-ip=177.85.215.210; receiver=mailrelay5i.vw.com.mx; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:177.85.215.0/24 ip4:168.196.188.0/23 -all"

X-Mailer

IAT-3118

Message-Id

<3118CLI28060808446abbf673046a4SMTP935303546@cloud3118.pesquisahsr2.com.br>

Extracted URLs

  • file http://corp1.pesquisahsr2.com.br/trc/l/333131387c7e7c3-335333033353436-7c7e7c517565726-56d6f73206f7576-697220737561204-f70696e69c3a36f-217c7e7c3231393-839313234347c7e-7c33313138434c4-932383036303830-383434366162626-636373330343661-34534d545039333-5333033353436.gif

  • file https://corp1.pesquisahsr2.com.br/trc/c/333131387c7e7c3-335333033353436-7c7e7c517565726-56d6f73206f7576-697220737561204%7D

  • file https://corp1.pesquisahsr2.com.br/trc/c/333131387c7e7c3-335333033353436-7c7e7c517565726-56d6f73206f7576-697220737561204-f70696e69c3a36f-217c7e7c3231393-839313234347c7e-7c68747470733a2-f2f636177692e66-617374717565737-42e6e65742f6672-6d6c6f67696e2e6-17370783f636f64-6a6f623d6125326-258704d6a7a7430-774b4d626f754e2-532623653794e67-253364253364266-16d703b43616d70-6f5431303d32312-6616d703b436f64-436c69656e74654-36177693d383234-387c7e7c3331313-8434c4932383036-303830383434366-162626636373330-34366134534d545-039333533303335-3436/