QuarantineMessage (9)[.]zip

QuarantineMessage (9).zip

SHA256 db224b561761f151870fd9b9c3468d86501110613e06a80651ed09422523c40c
MD5 3adc328f4a73aa885989b5a0d75e6a69
SHA1 e3480e410925dda12ce7d5c2a336913c6c4d09fe
SHA512 bf8a58e50e572a933b1fc9efc4ebb626a646b10771a1f5e4354c0d1beded75ab978189b1965809b313fb10d6d3993130b36652be7a12b519e04363665a048cd8
SSDEEP 3072:s58UzUSX/ZNmn7a2Yb/lAMKRJH6tweKPsl+ymqxfxOmYMlZCawpr0H0KoPZreiZM:OZAn7a2YmTRJkwlqb5xOmYM3TgP4iZ1y
TLSH
T16A042305E5F54EEFF8D60BCE6F0C8653A88AC1E84D04C364419FEA3BA27C1B5458B976
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

c0af0916-8ace-4600-89e8-08df2a14a4df/fffc17a0-fa16-9b74-6ded-5b5e4a41d94d.eml

SHA256 72905aae0d1fca8e4ffd56dc6919f588f042a09f16fc193934e3409d8c01f106
MD5 e45b655b706aeb0b663ed5418bd42f9d
SHA1 0a7fea86bf01968e9e173fe093cc5ebad38baa49
SHA512 d83d363d798886f83b3ab2bcfd3d4524f4d7314d77fa206a4b440cab60dc20899c7cbbbefa596fbeb17a4ec7737110b93f7683d84e4229ba9636eda3b0021b96
SSDEEP 6144:f0Zq3TOz3eiFZL3Uo8oeL/KJAWBaIylURtxIHjQSu0tQS5jadI:f0Zq3TODPrBwMNjmDDntQgjadI
TLSH
T11B54AEB0925AB7F1FCB2EC9CAC296D036C5405819202D9CDB849C3B527BF8B59E0ED74
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

[email protected]

Date

Wed, 14 Oct 2026 17:00:17 +0000

Subject

=?iso-8859-1?Q?Nuevo_contrato_de_pago_tramitado_por_Volcan_Compa=F1=EDa_M?= =?iso-8859-1?Q?inera_S.A.A_...?=

Content-Type

multipart/related; boundary="_005_CHAPR05MB998447ABBFF8FE391FEB2DCA3D919D2CHAPR05MB998447_"; type="multipart/alternative"

Received

from CY5PR12MB6575.namprd12.prod.outlook.com (2603:10b6:930:41::17) by DS0PR12MB7748.namprd12.prod.outlook.com with HTTPS; Wed, 14 Oct 2026 17:02:37 +0000

from CY8P220CA0040.NAMP220.PROD.OUTLOOK.COM (2603:10b6:930:47::10) by CY5PR12MB6575.namprd12.prod.outlook.com (2603:10b6:930:41::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.20; Wed, 14 Oct 2026 17:00:26 +0000

from CY7PEPF000000F2.namprd05.prod.outlook.com (2603:10b6:930:47:cafe::5) by CY8P220CA0040.outlook.office365.com (2603:10b6:930:47::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Wed, 14 Oct 2026 17:00:26 +0000

from mx0b-00797a01.pphosted.com (205.220.180.127) by CY7PEPF000000F2.mail.protection.outlook.com (10.167.247.150) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.6 via Frontend Transport; Wed, 14 Oct 2026 17:00:26 +0000

from pps.filterd (m0307836.ppops.net [127.0.0.1]) by mx0b-00797a01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69EEcLq9822825 for <[email protected]>; Wed, 14 Oct 2026 11:00:25 -0600

from co1pr03cu002.outbound.protection.outlook.com (mail-westus2azon11020132.outbound.protection.outlook.com [52.101.46.132]) by mx0b-00797a01.pphosted.com (PPS) with ESMTPS id 4h95v3jcup-5 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 14 Oct 2026 11:00:24 -0600 (CST)

from CHAPR05MB998447.namprd05.prod.outlook.com (2603:10b6:610:2f5::17) by CHBPR05MB106775.namprd05.prod.outlook.com (2603:10b6:610:402::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.13; Wed, 14 Oct 2026 17:00:17 +0000

from CHAPR05MB998447.namprd05.prod.outlook.com ([fe80::6a0d:b2ee:dbcd:e583]) by CHAPR05MB998447.namprd05.prod.outlook.com ([fe80::6a0d:b2ee:dbcd:e583%4]) with mapi id 15.21.0522.012; Wed, 14 Oct 2026 17:00:17 +0000

Received-Spf

Pass (protection.outlook.com: domain of volcan.com.pe designates 52.101.46.132 as permitted sender) receiver=protection.outlook.com; client-ip=52.101.46.132; helo=co1pr03cu002.outbound.protection.outlook.com; pr=C

Message-Id

<CHAPR05MB998447ABBFF8FE391FEB2DCA3D919D2@CHAPR05MB998447.namprd05.prod.outlook.com>

Extracted URLs

file http://www.volcan.com.pe/__;!!JUM8MZSoPTVp!dJTuYQetGQU0y1UoBmw0MF5EgnxQ2Hk4NS0cZtwyKfqA_Pqz8JQHGtR_eUtI1eYdppQ_Y0HIOOTPQTBRNUuUWA_q-rqO$
file http://www.volcan.com.pe__;!!JUM8MZSoPTVp!dJTuYQetGQU0y1UoBmw0MF5EgnxQ2Hk4NS0cZtwyKfqA_Pqz8JQHGtR_eUtI1eYdppQ_Y0HIOOTPQTBRNUuUWJcyXg2V$
file https://urldefense.com/v3/__
file https://urldefense.com/v3/__http://www.volcan.com.pe/__;!!JUM8MZSoPTVp!dJTuYQetGQU0y1UoBmw0MF5EgnxQ2Hk4NS0cZtwyKfqA_Pqz8JQHGtR_eUtI1eYdppQ_Y0HIOOTPQTBRNUuUWA_q-rqO$
file https://urldefense.com/v3/__https://www.vsk.info/vsk2/click.php?to=https:**Aproduct.blueberry-ai.com*share*t=3r9fhr3gom4sxzlkwo__;Ly8vPw!!JUM8MZSoPTVp!dJTuYQetGQU0y1UoBmw0MF5EgnxQ2Hk4NS0cZtwyKfqA_Pqz8JQHGtR_eUtI1eYdppQ_Y0HIOOTPQTBRNUuUWHpV7O82$
file https://www.vsk.info/vsk2/click.php?to=

email-html-2.txt

SHA256 02ff148f5dc73504d8b38e0874c629533c7f69151beade5f16d126523ebdee0f
MD5 444a3e85b12b02f859ba22cf56ead004
SHA1 956f325fd940d9495f448ad36d3810e624e95e4f
SHA512 b8f92de7a903e3d55ef4a740c026663a3b3346e42bef04a613e8e9ea158dc4a7fc015c93c384fb66f0e7687bccfb12271720e8f4a82b43326ad77e03123ff71d
SSDEEP 192:txSJ+WFN66/dyhnWFNtdtFgrhb3fbSXWFi6Bm1WFcad+vrJEbfto:yJ7FN661yhWFNtdjgdSmFi6w8Fca+Mo
TLSH
T1F3F12403F681290B53E789BEF213E79979864B44910BC5F921B522E7ACDFC7162923DC
MD5 SHA1 SHA512 SSDEEP TLSH

email-plain-1.txt

SHA256 70ee021863b81469f111908af75d4dcdbe16db1684bc9e964e317d3761eb3d88
MD5 ab8cd28ef4e67ec976f8a541d1746c0a
SHA1 d9d4831470f1285f987f2402c53aae08d802bbaf
SHA512 5a60ba1d573e060a9e58749457d77207879ed95c8b76f786929ed2de8f501cb1681d636c99fde9fa00223976090a46dfad117711f2f3dc468d4f23b4f1e12b79
TLSH
T1D61104AFCC43D54903E80A45BF6C7F4AA4199AC3D47880E5F17046902C4B8F6BCA5EEC
MD5 SHA1 SHA512 TLSH

image.png

SHA256 8f86fc73ece88117a98b4ea772cbe4753f58e9c5f62a6ffe729ca3103150206a
MD5 226965f5c2b570cc5b640a637250ef1d
SHA1 9f5cd51cc43f8b832635e0b268a05fef66350259
SHA512 3dfa37ea3fb47eefed87f735c422d7ea86fcc553c232c157b6f6247d286baaf158916cd405a42a7ab7d090cdaad4390661359e59c0a4f1d514ddfef930a9b778
SSDEEP 3072:WhH3pfz3Ts3i0ZeNbYRGVCs2CHYZU+nDYoBhi+a:S3pr+FWaE2C4nDZBhw
TLSH
T1CC049C13CE8436BF96918E55631378C5E0BD646BBA0A9F1F5F6216332C172C8F634C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer