Overview

overview

6

Static

static

4

Numero de ...06.msg

windows10-2004-x64

5

Numero de ...06.msg

windows11-ltsc_2024-x64

6

UBPD-1-202...41.zip

windows10-2004-x64

1

UBPD-1-202...41.zip

windows11-ltsc_2024-x64

1

UBPD-1-202...41.pdf

windows10-2004-x64

3

UBPD-1-202...41.pdf

windows11-ltsc_2024-x64

3

UBPD-1-202...po.pdf

windows10-2004-x64

3

UBPD-1-202...po.pdf

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Numero de Ticket 673006.msg
  • Size 444KB
  • Sample261022-zzapsatzdt
  • SHA256 408eebd247ba22edbe65800f08f21b4f3438f9b69ecaa7c4136f8860826a6d78
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
pdflinkqr

Malware Config

Signatures

  • HTTP links in PDF interactive object 2 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • PDF has QR code that contains a HTTP URL

    PDFs with URL QR codes are often used for phishing

    pdfqr
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • One or more email addresses in PDF identified

    Detects presence of email addresses in PDF files.

    pdf

File Explorer

  • Numero de Ticket 673006.msg
    .msg 444KB
  • UBPD-1-2026-020441.zip
    .zip 334KB
  • UBPD-1-2026-020441.pdf
    .pdf 288KB
  • UBPD-1-2026-020441_NoticiaElTiempo.pdf
    .pdf 110KB

Numero de Ticket 673006.msg

  • SHA256 408eebd247ba22edbe65800f08f21b4f3438f9b69ecaa7c4136f8860826a6d78
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 22 Oct 2026 17:36:03 +0000

Subject

Numero de Ticket 673006

Content-Type

multipart/mixed; boundary="--==_mimepart_6ada498448e9a_f5b30c46025ae"; charset=UTF-8

Received

from CH0PR13MB5154.namprd13.prod.outlook.com (::1) by DS7PR13MB4639.namprd13.prod.outlook.com with HTTPS; Thu, 22 Oct 2026 17:37:01 +0000

from MW4PR04CA0318.namprd04.prod.outlook.com (2603:10b6:303:82::23) by CH0PR13MB5154.namprd13.prod.outlook.com (2603:10b6:610:ff::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.19; Thu, 22 Oct 2026 17:36:07 +0000

from MWH0EPF000C6188.namprd02.prod.outlook.com (2603:10b6:303:82:cafe::36) by MW4PR04CA0318.outlook.office365.com (2603:10b6:303:82::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.16 via Frontend Transport; Thu, 22 Oct 2026 17:36:06 +0000

from mta-out2.pod27.use2.zdsys.com (192.161.152.32) by MWH0EPF000C6188.mail.protection.outlook.com (10.167.249.120) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Thu, 22 Oct 2026 17:36:05 +0000

from unknown (unknown [127.0.0.6]) by mta-out15.pod27.use2.zdsys.com (Zendesk) with HTTP id 7af7147e-80e2-44be-8b57-616ba0e2688e; Thu, 22 Oct 2026 17:36:04 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of eltiempo.com designates 192.161.152.32 as permitted sender) receiver=protection.outlook.com; client-ip=192.161.152.32; helo=mta-out2.pod27.use2.zdsys.com; pr=C

X-Mailer

Zendesk Mailer

Message-Id

<c11n+0de48aec-ce3f-11f1-99f0-fd1825ecd1c0+0de48aec-ce3f-11f1-99f0-fd1825ecd1c0+[email protected]>

Extracted URLs

  • file http://unidadbusqueda.gov.co

  • file https://eltiempo.zendesk.com/attachments/token/TZRDSlFdkavQUmq0OVTytu4tp/?name=unnamed_attachment_1.png

  • file https://pqrsd.unidadbusqueda.gov.co/Account/Login?ReturnUrl=%2F

  • file https://sabackupcenturylink.blob.core.windows.net/prueba-correo/prueba%20correo.png

  • file https://unidadbusqueda.gov.co