202611092238_Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026_ecruz.zip
- SHA256 dedc45de27c193b6f9297dd53215b1dae6966f9d2ab5424e1e579a8efad07a48
Static task
static1
Behavioral task
behavioral1
Sample
20261109140320-Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026-ecruz.eml
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
20261109140320-Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026-ecruz.eml
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
email-html-2.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
email-html-2.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 202611092238_Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026_ecruz.zip
- Size 140KB
- Sample261110-e9wpsach48
- SHA256 dedc45de27c193b6f9297dd53215b1dae6966f9d2ab5424e1e579a8efad07a48
- MD5 2e6a8d59f4fd9211df8ec1cefa09aa0d
- SHA1 69b0efcffb881cf0271d7d050e2e2005eb85de1d
- SHA512 ce2625ef0c15eb0f5fd680fa25683bc378ce7c0c2495a9c8b4ead37dffaef504874684c10065c96ef0dfe05add62717ec00bde4c6812c6ec7a893c37362f6fb3
- SSDEEP 3072:JwgAyUct49ZOZz61pRFkLUkz1RbB9w8K2BufNCR:PAbct49ZOZz6yzB9wICY
- TLSH T13FE32358380858D17C0292B1DB9A9DDF809D565384ED2DA97C7B033D8EE41B6CF2F1AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
202611092238_Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026_ecruz.zip.zip 140KB
-
20261109140320-Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026-ecruz.eml.eml 671KB
-
email-html-2.txt.html 71KB
-
email-plain-1.txt11KB
-
image001.png.png 24KB
-
image002.gif.gif 173KB
20261109140320-Re_ DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026-ecruz.eml
- SHA256 ef500a90ee6bd9b369440bed24cc9ab374517b87bc9f997694f741d5812c2cca
- MD5 3ef4bd775de9b43a2ec3290bafb1479e
- SHA1 b09f2a5b41c04259f8acdc97ab7059e7ade50dc8
- SHA512 2e7e64c85b589e42a55aa2c758c29eee91e520c2a2cc98e61b8434d6c021b467bd6a35bed01bf1b60ac4efa039a7daac9118b8dcd6b3ead09f8c575f2cc5928b
- SSDEEP 3072:nn5Zs8JoBtnIzxNffe99GxsoKnWgS84HOOwMnCIdI8jKzZF1XbJTmX19Zu22HgL9:n5Zs8JoBtn2xZfMGBKWgLGBKWgA
- TLSH T1E3E4ADBB15B37B9FE6530D40CD083A648E36BE87416181B8BCDD46BFD8BE970095E990
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
In-Reply-To
BN7PR17MB2338CB0FCD1E242E01FA4810E1732@BN7PR17MB2338.namprd17.prod.outlook.com
Date
Mon, 9 Nov 2026 14:02:53 +0000
Subject
CAS::Re: DOCUMENTOS VIAJES Y RETORNOS VAS REALIZADOS DEL 16 AL 31 DE OCTUBRE 2026
Content-Type
multipart/related; boundary="_007_CALikBfqHZQTSLA8XfMZiOCC3yz9OGZHxSJHCYSRoS857gQmailgmai_"; type="multipart/alternative"
Received
from SA1PR22MB4000.namprd22.prod.outlook.com (2603:10b6:806:327::16) by CH3PR22MB4566.namprd22.prod.outlook.com with HTTPS; Mon, 9 Nov 2026 14:03:19 +0000
from PH8PR21CA0017.namprd21.prod.outlook.com (2603:10b6:510:2ce::17) by SA1PR22MB4000.namprd22.prod.outlook.com (2603:10b6:806:327::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.12; Mon, 9 Nov 2026 14:03:10 +0000
from SJ1PEPF000037A6.namprd04.prod.outlook.com (2603:10b6:510:2ce:cafe::6b) by PH8PR21CA0017.outlook.office365.com (2603:10b6:510:2ce::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.639.0 via Frontend Transport; Mon, 9 Nov 2026 14:03:08 +0000
from mail-oo1-xc35.google.com (2607:f8b0:4864:20::c35) by SJ1PEPF000037A6.mail.protection.outlook.com (2603:10b6:a0f:fc02::5ba) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.615.4 via Frontend Transport; Mon, 9 Nov 2026 14:03:07 +0000
by mail-oo1-xc35.google.com with SMTP id 006d021491bc7-6deb848ddd7so523558eaf.0 for <[email protected]>; Mon, 09 Nov 2026 06:03:07 -0800 (PST)
X-Received
by 2002:a05:6820:858c:10b0:715:24e6:9528 with SMTP id 006d021491bc7-7170f368ad2mr1259283eaf.89.1794232986170; Mon, 09 Nov 2026 06:03:06 -0800 (PST)
Received-Spf
Pass (protection.outlook.com: domain of gmail.com designates 2607:f8b0:4864:20::c35 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::c35; helo=mail-oo1-xc35.google.com; pr=C
Message-Id
<CALikBfqH_ZQ=TSLA8XfM=Z-iOCC3yz9OGZHxSJHCYSRoS857gQ@mail.gmail.com>
Extracted URLs
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1MFKT7yelDFyD9F69twEGSs9yqQdHzupg%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787439693%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3dXm0A8t9b65EjT5BaR6%252BnR8MmA%252B0LOzOIKn6aiFOKSGw%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-8c1d67b85857a83baddb066be5d378fc476f76ea
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1MFKT7yelDFyD9F69twEGSs9yqQdHzupg%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787469000%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3dkhNTOj3%252B8rqfmGyT%252F8eUY%252F9ORUuuDZeI4dE0j1yYa5Q%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-2c6a7682fc358a13dead31b77b52c6357691f62f
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1cZ6wkQvgXZXb0s_LgTXP_6lKcU2GXs4o%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787543009%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3d7NklXPUARxdie86CtjMkFy1tTSY%252BlKnZAc2ymrKepz4%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-a19f560b0ecc88be8707da7c2deb34b55510416c
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1cZ6wkQvgXZXb0s_LgTXP_6lKcU2GXs4o%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787670764%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3dXiUl65rAMrd59iYiHHZBZTfP7vED8G1fNg9Z9FUEvcA%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-45bfbde6027f56b730323c4aafd5365bc015f5ff
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1yUuaYmoFsVz3D44drcrL0Aw-zY63jhPD%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787494317%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3dvS5KJP7zJeMpGlG4JZDv3DwPHmf85npo%252BHZoiJrpET8%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-45a1032f9103cf5e6f2f653984ca4cd50fc0c7bf
-
file https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fnam02.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fdrive.google.com%252Ffile%252Fd%252F1yUuaYmoFsVz3D44drcrL0Aw-zY63jhPD%252Fview%253Fusp%253Ddrivesdk%26data%3d05%257C02%257Cbgjefeadmon2%2540cemaco.com%257C72206463731b450fc03208df3dfb8de8%257C7944ce027df94a4a97ac85a2b2f936cb%257C1%257C0%257C639297822787519274%257CUnknown%257CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%253D%253D%257C0%257C%257C%257C%26sdata%3d97jTa3Ho15yjM6F0IIDcdn87Psr6N0%252FYE3H8YkmE7Js%253D%26reserved%3d0&umid=4dfe0e45-c29a-42b6-9f99-3be6a1275664&rct=1794185479&auth=c564b588002ddfb2e3a57d6b1ad4c3aa54db3a30-4ab48a76c0447fc859398f5f8bdc0cc5083ed324
-
file https://drive-thirdparty.googleusercontent.com/256/type/application/pdf]
email-html-2.txt
- SHA256 7291e92b0bbb8295196d5c4ef561dc3e9a169139c510ab2e26dc1763719bc112
- MD5 45532904ac7a84404d0b438e4d0ec07d
- SHA1 d6f2951c685eaea49c90e9171dd2ffe91a226b0a
- SHA512 0b45ca41bcff50aa1adca84da4aab335172653faf43dba77035032926830609952ea5e3b9ba7b5aee993c0f85c43c4502f4cdd53702d02ab48df33da28756015
- SSDEEP 768:5362QJcdHHN3NFpW8eKIV6U6j61606zljS4FjLq5kbedv5xNvUu+VwOSXZJmjryK:UclHN3NFpW8ph0+
- TLSH T1AF73FE11D6A9186391F985F9F01B5B6ED0C1734593274BE2F3E9787378C78A222A738C
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 8f4637c98eb8921532e6ac9bef49aa9d843602957d06aabb68be535507f5a592
- MD5 0ffe4e14c2251ed7fde745d2ea1b0528
- SHA1 d313af377b54fe58ac4e59ddeb39385119612cee
- SHA512 a1671b7b30c4928915f27cecb33ff4b128c735e98f0e8b9bf7076e06c25f7a219f8016b2d78df09d723186d02e90dcfa3d32af5a1b8b1bffd20dff9d05dd1281
- SSDEEP 192:Ae4wpKRNNyVm9yNlJgyNcJI9yHJoyDJT9yYJS/yJJKdPGRDhMsp+aUYem9:AgKbYVmcNLNlcxZctqecz7RV9
- TLSH T11C32D6F55D8A108653BF9310E3CC993AF5209282D5DA8B81F2EDA71E47CC98CA649D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
image001.png
- SHA256 eb0de431e23308affab7c196f02dafb34eb0f1cef4cc17a883ee707c7e5fc260
- MD5 01db949e9d03237242a6a3f02618eef7
- SHA1 73ee1205bc812d000e6b0ff693db6c45f9166fc4
- SHA512 78565780e46cd4c6bcac0aa92a81258fea9b5bcbe34fcf58f9ed9ab7c9a4640dc7bbe5cf61783040a722b17f352be912711578e5c3007b9df0da892eedb1010b
- SSDEEP 768:rEskggbhKS05WXiht6dQgicqpw7rQ6zdCYR:QkE0t6dQHBpwPhCg
- TLSH T16CB2BEAE6C95CFBA0C1B6606AB7D80BC5A1712F7470FA7E752454D5930DF3E00FA6620
- MD5 SHA1 SHA512 SSDEEP TLSH
image002.gif
- SHA256 302b77d670510eb39fb21a9e024109b7dd6bdf69805fb19a8e9246734d814d98
- MD5 ae268d85e38e6860390ebba03974c80d
- SHA1 41f59cb080ccbbb0d9c0703bc39a36e7d55e2099
- SHA512 5c0adf1fc16c71c5b554f16c43ca4a1f62fdd2961df2f6ebfe5dcb11c583e882f3cfa8e1bb7a24a0ba7402deac42e4b24ab60acc403387f0322a8e732a4f03e5
- SSDEEP 768:icrIPmfSRwDsTav210rAn+vqpoTELy5NOtML4/WfCBgjcD31PmldRwXtTaZ1107j:oJl
- TLSH T15304C79C02B3DC4CED374C76127A164B0AC00E9ECEC2C86AD5D455B237D5B7B1AAD68E
- MD5 SHA1 SHA512 SSDEEP TLSH