Overview

overview

7

Static

static

1

Seu boleto...o!.eml

windows10-ltsc_2021-x64

7

email-html-2.html

windows10-ltsc_2021-x64

3

email-plain-1.txt

windows10-ltsc_2021-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Seu boleto ainda está em aberto!.eml
  • Size 39KB
  • Sample261002-w58bfsverd
  • SHA256 fb86974cf5de5cef6c06f4a406827e83fb10e1c1a37768b4b66f94db7e7a51f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Seu boleto ainda está em aberto!.eml
    .eml 39KB
  • email-html-2.txt
    .html 21KB
  • email-plain-1.txt
    1KB

Seu boleto ainda está em aberto!.eml

  • SHA256 fb86974cf5de5cef6c06f4a406827e83fb10e1c1a37768b4b66f94db7e7a51f3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Delivered-To

[email protected]

Return-Path

<recebimentofiscal+[email protected]>

Date

Wed, 30 Sep 2026 14:15:37 +0000

Subject

=?utf-8?Q?Seu=20boleto=20ainda=20est=C3=A1=20em=20aberto!?=

Content-Type

multipart/alternative; boundary="_av-AheV0em79NUKZoDGt5_oJw"

Received

by 2002:a05:622a:4e86:b0:533:3ae0:ab2c with SMTP id dj6csp693432qtb; Wed, 30 Sep 2026 07:15:40 -0700 (PDT)

from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id 586e51a60fabf-49ded275e71sor89794fac.12.2026.09.30.07.15.39 for <[email protected]> (Google Transport Security); Wed, 30 Sep 2026 07:15:39 -0700 (PDT)

by 2002:a05:6871:ea:b0:46c:347e:40e3 with SMTP id 586e51a60fabf-492fb63b202ls7368494fac.2.-pod-prod-09-us; Wed, 30 Sep 2026 07:15:38 -0700 (PDT)

from mail145-27.atl61.mandrillapp.com (mail145-27.atl61.mandrillapp.com. [198.2.145.27]) by mx.google.com with ESMTPS id 5614622812f47-4f1b5ed43afsi2115110b6e.27.2026.09.30.07.15.37 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Sep 2026 07:15:38 -0700 (PDT)

from mta003-md-use2.delv.a.intuit.com (localhost [127.0.0.1]) by mail145-27.atl61.mandrillapp.com (Mailchimp) with ESMTP id 4hvxsP2nMGzDRStNH for <[email protected]>; Wed, 30 Sep 2026 14:15:37 +0000 (UTC)

from [52.177.183.215] by mandrillapp.com id a827842d27b749a09ace5e380debdfc0; Wed, 30 Sep 2026 14:15:37 +0000

X-Received

by 2002:a05:6871:789:b0:475:e235:904 with SMTP id 586e51a60fabf-49dddaa4eb5mr1371429fac.34.1790777740050; Wed, 30 Sep 2026 07:15:40 -0700 (PDT)

by 2002:a05:6870:5703:b0:494:ad56:c418 with SMTP id 586e51a60fabf-49dddb57c64mr1352857fac.50.1790777739276; Wed, 30 Sep 2026 07:15:39 -0700 (PDT)

by 2002:a05:6808:4497:b0:4c5:cd9d:c6de with SMTP id 5614622812f47-4f1b0c11305mr1608414b6e.7.1790777738371; Wed, 30 Sep 2026 07:15:38 -0700 (PDT)

Received-Spf

pass (google.com: domain of recebimentofiscal+[email protected] designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;

pass (google.com: domain of bounce-md_31012996.6abd1989.v1-a827842d27b749a09ace5e380debdfc0@mandrillapp.com designates 198.2.145.27 as permitted sender) client-ip=198.2.145.27;

Message-Id

<31012996.20260930141537.6abd1989580241.76047900@mail145-27.atl61.mandrillapp.com>

Extracted URLs

  • file http://www.lacoscorporativos.com.br

  • file https://api.whatsapp.com/send/?phone=558007771986&text=Ol%C3%A1+La%C3%A7os%2C+Recebi+um+e-mail+sobre+uma+cobran%C3%A7a+em+aberto%2C+podem+me+ajudar%3F&type=phone_number&app_absent=0

  • file https://app.rdstation.com.br/descadastrar/*UUID*

  • file https://app.rdstation.com.br/mail/*UUID*

  • file https://mandrillapp.com/track/click/31012996/api.whatsapp.com?p=eyJzIjoidWRqekRQR0l1M0RNejJNZlpwSmZOQUg2Vlh3IiwidiI6MiwicCI6IntcInVcIjozMTAxMjk5NixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwaS53aGF0c2FwcC5jb21cXFwvc2VuZFxcXC8_cGhvbmU9NTU4MDA3NzcxOTg2JnRleHQ9T2wlQzMlQTErTGElQzMlQTdvcyUyQytSZWNlYmkrdW0rZS1tYWlsK3NvYnJlK3VtYStjb2JyYW4lQzMlQTdhK2VtK2FiZXJ0byUyQytwb2RlbSttZSthanVkYXIlM0YmdHlwZT1waG9uZV9udW1iZXImYXBwX2Fic2VudD0wXCIsXCJpZFwiOlwiYTgyNzg0MmQyN2I3NDlhMDlhY2U1ZTM4MGRlYmRmYzBcIixcInVybF9pZHNcIjpbXCI2OTA3NmU3MWVkZDcyMTAwZDg5OGIyMzMyZDQwNDg0NjNlOTUzNjIyXCJdLFwibXNnX3RzXCI6MTc5MDc3NzczN30ifQ

  • file https://mandrillapp.com/track/click/31012996/app.rdstation.com.br?p=eyJzIjoiRHA5dzg1bnplRnM2VHlqM3VXMzFhY2FlMENBIiwidiI6MiwicCI6IntcInVcIjozMTAxMjk5NixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5yZHN0YXRpb24uY29tLmJyXFxcL21haWxcXFwvKlVVSUQqXCIsXCJpZFwiOlwiYTgyNzg0MmQyN2I3NDlhMDlhY2U1ZTM4MGRlYmRmYzBcIixcInVybF9pZHNcIjpbXCIyNDlhNzU3MjZhZTc3MDcyNWRkMGM3ZTkyNmFiYjc5ZDczZTJkYzA5XCJdLFwibXNnX3RzXCI6MTc5MDc3NzczN30ifQ

  • file https://mandrillapp.com/track/click/31012996/app.rdstation.com.br?p=eyJzIjoiUVJHU1RCRW15TTBMLUpHNG9XZzdzM0QyMEVvIiwidiI6MiwicCI6IntcInVcIjozMTAxMjk5NixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5yZHN0YXRpb24uY29tLmJyXFxcL2Rlc2NhZGFzdHJhclxcXC8qVVVJRCpcIixcImlkXCI6XCJhODI3ODQyZDI3Yjc0OWEwOWFjZTVlMzgwZGViZGZjMFwiLFwidXJsX2lkc1wiOltcIjlhZjc5M2JiYWNkYTVlNTI0Y2JlZTllZmE5NTE5MjlmNDQ1ZDAxYWNcIl0sXCJtc2dfdHNcIjoxNzkwNzc3NzM3fSJ9

  • file https://mandrillapp.com/track/click/31012996/web.facebook.com?p=eyJzIjoiZDdDNlc0a3lUQ0JEc2JNM054T0w3MDB2VFIwIiwidiI6MiwicCI6IntcInVcIjozMTAxMjk5NixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3dlYi5mYWNlYm9vay5jb21cXFwvTGFjb3NDb3Jwb3JhdGl2b3NcXFwvXCIsXCJpZFwiOlwiYTgyNzg0MmQyN2I3NDlhMDlhY2U1ZTM4MGRlYmRmYzBcIixcInVybF9pZHNcIjpbXCI1MDBmNjAyM2E1OTI3Y2I5OWRiODM3NjAzM2NlN2ZkOTgwYTViNjAyXCJdLFwibXNnX3RzXCI6MTc5MDc3NzczN30ifQ

  • file https://mandrillapp.com/track/click/31012996/www.coroasparavelorio.com.br?p=eyJzIjoiQXJTSXVqT2QtNGVoT1VqZnUzamEzYXNhaHBNIiwidiI6MiwicCI6IntcInVcIjozMTAxMjk5NixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jb3JvYXNwYXJhdmVsb3Jpby5jb20uYnJcXFwvYm9sZXRvXFxcL0VtcHJlc2FDb2JyYW5jYT9QPTE2Nzg4NyZGPTk1NzU4XCIsXCJpZFwiOlwiYTgyNzg0MmQyN2I3NDlhMDlhY2U1ZTM4MGRlYmRmYzBcIixcInVybF9pZHNcIjpbXCJmNWM5OTdkNjEyOGU5MmJmOTA5MGE3MDNhYTQxNmY0MWZmMTRjZjJhXCJdLFwibXNnX3RzXCI6MTc5MDc3NzczN30ifQ

  • Show all