Static

static

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    A fatura do seu cartão ITAU UNICLASS VISA já está fechada.msg
  • Size 691KB
  • Sample260930-tcc9haygnc
  • SHA256 71f81f2e4868c44143d74b2141916869ed4445d224fdd7105ab91d2623a3081d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

    pdf

File Explorer

  • A fatura do seu cartão ITAU UNICLASS VISA já está fechada.msg
    .msg 691KB
  • Fatura_VISA.pdf
    .pdf 398KB

A fatura do seu cartão ITAU UNICLASS VISA já está fechada.msg

  • SHA256 71f81f2e4868c44143d74b2141916869ed4445d224fdd7105ab91d2623a3081d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

18 Sep 2026 23:22:31 -0300

Subject

=?UTF-8?B?QSBmYXR1cmEgZG8gc2V1IGNhcnTDo28gSVRBVSBVTklDTEFTUyBWSVNBIGrDoSBlc3TDoSBmZWNoYWRh?=

Content-Type

multipart/mixed; boundary="----=_NextPart_000_0012_0249F61F.5A1E88A5"

Received

from AM9PR03MB7266.eurprd03.prod.outlook.com (::1) by VI1PR03MB9986.eurprd03.prod.outlook.com with HTTPS; Sat, 19 Sep 2026 02:38:29 +0000

from PR1P264CA0128.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2ce::14) by AM9PR03MB7266.eurprd03.prod.outlook.com (2603:10a6:20b:261::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 02:37:54 +0000

from MI3PEPF00008550.eurprd05.prod.outlook.com (2603:10a6:102:2ce:cafe::86) by PR1P264CA0128.outlook.office365.com (2603:10a6:102:2ce::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.14 via Frontend Transport; Sat, 19 Sep 2026 02:37:54 +0000

from CH4PR04CU002.outbound.protection.outlook.com (2a01:111:f403:e01b::3) by MI3PEPF00008550.mail.protection.outlook.com (2603:10a6:298:1::84) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sat, 19 Sep 2026 02:37:54 +0000

from BY1P220CA0015.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:5c3::10) by RO2P152MB5140.LAMP152.PROD.OUTLOOK.COM (2603:10d6:10:be::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.13; Sat, 19 Sep 2026 02:37:44 +0000

from BY1PEPF00026968.namprd05.prod.outlook.com (2603:10b6:a03:5c3:cafe::9e) by BY1P220CA0015.outlook.office365.com (2603:10b6:a03:5c3::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.13 via Frontend Transport; Sat, 19 Sep 2026 02:37:42 +0000

from CH4PR04CU002.outbound.protection.outlook.com (2a01:111:f403:e01b::3) by BY1PEPF00026968.mail.protection.outlook.com (2603:10b6:a0f:fc02::5c8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sat, 19 Sep 2026 02:37:41 +0000

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning noreply.coelhoegraciano.adv.br discourages use of 2a01:111:f403:e01b::3 as permitted sender)

SoftFail (protection.outlook.com: domain of transitioning noreply.coelhoegraciano.adv.br discourages use of 2a01:111:f403:e01b::3 as permitted sender)

SoftFail (protection.outlook.com: domain of transitioning noreply.coelhoegraciano.adv.br discourages use of 204.44.103.203 as permitted sender)

Message-Id

<[email protected]>