General

  • Target
    INSISTÊNCIA) Pedido de documentação bancária - Inquérito nº 382_26.4PAPVZ.eml
  • Size 792KB
  • Sample260930-pd5b6aeg65
  • SHA256 21c550271ebc6a1433a3ea193c5c9027f132004fe11604a4508f496ce23ce127
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

File Explorer

  • INSISTÊNCIA) Pedido de documentação bancária - Inquérito nº 382_26.4PAPVZ.eml
    .eml 792KB
  • 94a3d83d-8e3d-454e-8f51-874f3738a3e0_temp.pdf
    .pdf 527KB
  • email-html-2.txt
    .html 2KB
  • email-plain-1.txt
    836B
  • image001.jpg
    .jpg 19KB

INSISTÊNCIA) Pedido de documentação bancária - Inquérito nº 382_26.4PAPVZ.eml

  • SHA256 21c550271ebc6a1433a3ea193c5c9027f132004fe11604a4508f496ce23ce127
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

AM0PR08MB42420C1CE5F31D61BD4E795C95B92@AM0PR08MB4242.eurprd08.prod.outlook.com

Return-Path

bounces+[email protected]

Date

Wed, 30 Sep 2026 09:14:47 +0000

Subject

=?iso-8859-1?Q?INSIST=CANCIA)_Pedido_de_documenta=E7=E3o_banc=E1ria_-_Inq?= =?iso-8859-1?Q?u=E9rito_n=BA_382/26.4PAPVZ?=

Content-Type

multipart/mixed; boundary="_006_AM0PR08MB4242B2B63590821F10A54950958B2AM0PR08MB4242eurp_"

Received

from BESPR03MB911329.eurprd03.prod.outlook.com (::1) by AM6PR03MB4568.eurprd03.prod.outlook.com with HTTPS; Wed, 30 Sep 2026 09:16:16 +0000

from MA3P292CA0002.ESPP292.PROD.OUTLOOK.COM (2603:10a6:250:2c::17) by BESPR03MB911329.eurprd03.prod.outlook.com (2603:10a6:b10:108::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Wed, 30 Sep 2026 09:16:12 +0000

from MA3PEPF00000406.eurprd04.prod.outlook.com (2603:10a6:250:2c:cafe::a3) by MA3P292CA0002.outlook.office365.com (2603:10a6:250:2c::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Wed, 30 Sep 2026 09:16:12 +0000

from nat.eu.perception-point.io (99.80.189.20) by MA3PEPF00000406.mail.protection.outlook.com (10.167.241.151) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 09:16:11 +0000

from AM0PR07CU002.outbound.protection.outlook.com (mail-am0pr07cu00204.outbound.protection.outlook.com [40.93.65.68]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id ggmgbquuliiiphilb55mg02ck10tr8vhcm0h2bo1 for [email protected]; Wed, 30 Sep 2026 09:16:05 +0000 (UTC)

from DU2PR04CA0336.eurprd04.prod.outlook.com (2603:10a6:10:2b4::15) by GV1PR03MB10728.eurprd03.prod.outlook.com (2603:10a6:150:202::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Wed, 30 Sep 2026 09:15:23 +0000

from DB1PEPF000509E8.eurprd03.prod.outlook.com (2603:10a6:10:2b4:cafe::2a) by DU2PR04CA0336.outlook.office365.com (2603:10a6:10:2b4::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 09:15:23 +0000

from DU2PR03CU002.outbound.protection.outlook.com (2a01:111:f403:c200::3) by DB1PEPF000509E8.mail.protection.outlook.com (2603:10a6:18:3::61a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 09:15:23 +0000

from PAZP264CA0217.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:237::26) by DB3PR10MB6859.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:42a::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Wed, 30 Sep 2026 09:15:08 +0000

from MAD0EPF000008C2.eurprd05.prod.outlook.com (2603:10a6:102:237:cafe::21) by PAZP264CA0217.outlook.office365.com (2603:10a6:102:237::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 09:15:06 +0000

from mailgw.mj.pt (91.198.182.7) by MAD0EPF000008C2.mail.protection.outlook.com (10.167.241.198) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 09:15:06 +0000

from unknown (HELO mail.justica.gov.pt) ([10.0.158.232]) by relay02.mj.pt with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Sep 2026 10:15:02 +0100

from EXCASP08.justica.local (10.0.158.231) by EXCASP09.justica.local (10.0.158.232) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Wed, 30 Sep 2026 10:14:57 +0100

from AS8PR07CU003.outbound.protection.outlook.com (40.93.65.54) by EXCASP08.justica.local (10.0.158.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37 via Frontend Transport; Wed, 30 Sep 2026 10:14:56 +0100

from AM0PR08MB4242.eurprd08.prod.outlook.com (2603:10a6:208:148::17) by GV2PR08MB11420.eurprd08.prod.outlook.com (2603:10a6:150:2b1::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14; Wed, 30 Sep 2026 09:14:50 +0000

from AM0PR08MB4242.eurprd08.prod.outlook.com ([fe80::dfdc:4898:911e:4417]) by AM0PR08MB4242.eurprd08.prod.outlook.com ([fe80::dfdc:4898:911e:4417%5]) with mapi id 15.21.0472.012; Wed, 30 Sep 2026 09:14:47 +0000

Received-Spf

Fail (protection.outlook.com: domain of wizink365.onmicrosoft.com does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of wizink365.onmicrosoft.com designates 40.93.65.68 as permitted sender) client-ip=40.93.65.68; envelope-from=bounces+[email protected]; helo=AM0PR07CU002.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of wizink365.onmicrosoft.com designates 2a01:111:f403:c200::3 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c200::3; helo=DU2PR03CU002.outbound.protection.outlook.com; pr=C

Pass (protection.outlook.com: domain of tribunais.org.pt designates 91.198.182.7 as permitted sender) receiver=protection.outlook.com; client-ip=91.198.182.7; helo=mailgw.mj.pt; pr=C

Message-Id

<AM0PR08MB4242B2B63590821F10A54950958B2@AM0PR08MB4242.eurprd08.prod.outlook.com>