General

  • Target
    Envío de póliza No. 91-8357102 Automóvil LC Guatemala, S.A..A
  • Size 2.7MB
  • Sample261002-s8611sdd75
  • SHA256 6b740ab461baa973cc7536bf6340c95b2bb51a1380bedc72a8940870bec459b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
pdf

Malware Config

Signatures

  • Malformed data in PDF

    A PDF can contain malformed data to evade detection

File Explorer

  • Envío de póliza No. 91-8357102 Automóvil LC Guatemala, S.A..A
    .eml 2.7MB
  • 17907168176abc2b918644c.pdf
    .pdf 11KB
  • 71080_FEL-FEA-341_319836.pdf
    .pdf 854KB
  • ID.pdf
    .pdf 141KB
  • Renovacion 91-8357102.pdf
    .pdf 1014KB
  • email-html-2.txt
    .html 10KB
  • email-plain-1.txt
    4KB

Envío de póliza No. 91-8357102 Automóvil LC Guatemala, S.A..A

  • SHA256 6b740ab461baa973cc7536bf6340c95b2bb51a1380bedc72a8940870bec459b4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

In-Reply-To

CAP8vLEtn5r5pNqkeLA4eM616mG-_3N5q7EZvgCfCYwGOnCE7bg@mail.gmail.com

Date

Tue, 29 Sep 2026 21:35:49 +0000

Subject

=?utf-8?B?RW52w61vIGRlIHDDs2xpemEgTm8uIDkxLTgzNTcxMDIgfCBBdXRvbcOzdmls?= =?utf-8?Q?_|_LC_Guatemala,_S.A.?=

Content-Type

multipart/mixed; boundary="_007_CAP8vLEs7zKqNKGVjTSd7ochBRd5QO4JsPEAz4rq2pb4fwJ5gmailgm_"

Received

from SA5PPFBA609D7BE.namprd16.prod.outlook.com (::1) by SA1PR16MB5151.namprd16.prod.outlook.com with HTTPS; Tue, 29 Sep 2026 21:40:49 +0000

from BN9PR03CA0152.namprd03.prod.outlook.com (2603:10b6:408:f4::7) by SA5PPFBA609D7BE.namprd16.prod.outlook.com (2603:10b6:80f:fc04::91f) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 21:40:38 +0000

from BN2PEPF0000A991.namprd04.prod.outlook.com (2603:10b6:408:f4:cafe::32) by BN9PR03CA0152.outlook.office365.com (2603:10b6:408:f4::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 21:40:37 +0000

from webaccess.bi.com.gt (190.242.184.172) by BN2PEPF0000A991.mail.protection.outlook.com (10.167.248.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Tue, 29 Sep 2026 21:40:36 +0000

from SRVCTR023MAIL.bi-central.local (10.10.10.155) by webaccess.bi.com.gt (10.10.10.237) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 29 Sep 2026 15:34:03 -0600

from SRVCTR020MAIL.bi-central.local (10.1.1.206) by SRVCTR023MAIL.bi-central.local (10.1.1.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 29 Sep 2026 15:37:07 -0600

from outbound-ip62b.ess.barracuda.com (10.2.4.214) by SRVCTR020MAIL.bi-central.local (10.1.1.206) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43 via Frontend Transport; Tue, 29 Sep 2026 15:37:07 -0600

from mail-qk2-f38.google.com (mail-qk2-f38.google.com [74.125.230.230]) by mx-inbound45-217.us-east-2c.ess.aws.cudaops.com (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 29 Sep 2026 21:36:29 +0000

by mail-qk2-f38.google.com with SMTP id d75a77b69052e-53336049862so27469171cf.3 for <[email protected]>; Tue, 29 Sep 2026 14:36:29 -0700 (PDT)

Received-Spf

pass (mx-inbound45-217.us-east-2c.ess.aws.cudaops.com: domain of [email protected] designates 74.125.230.230 as permitted sender)

Message-Id

<CAP8vLEs7zKqN+[email protected]>

Extracted URLs

  • file https://cobrosweb.elroble.com/mis-pagos

  • file https://linkprotect.cudasvc.com/url?a=