FRAUDE - EMAIL
Assunto da mensagem: Notificação de Emissão de Nota Fiscal Eletrônica (15158)
Data de inclusão: 13/12/17
O usuário recebe uma mensagem contendo um arquivos disponível para download, no entanto o arquivo originado é malicioso criado para roubar informações da vítima e instalar outros arquivos fraudulentos.
Conteúdo da mensagem
###############################################################################
# !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! #
# #
# O TEXTO ABAIXO FOI TRANSCRITO A PARTIR DE UMA FRAUDE CADASTRADA EM NOSSOS #
# SISTEMAS ATRAVES DA COLETA DE DADOS NA INTERNET E/OU CONTRIBUICAO DE #
# PARCEIROS E/OU USUARIOS. #
# #
# EM CASO DE DUVIDAS ENTRE EM CONTATO ATRAVES DO EMAIL: cais@cais.rnp.br #
# #
# OBRIGADO. #
# #
# CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) #
# REDE NACIONAL DE ENSINO E PESQUISA (RNP) #
###############################################################################
Return-Path: jader.pinto@conduspar.com.br
Received: from localhost (LHLO mail.pop-ba.rnp.br) (127.0.0.1) by
mail.pop-ba.rnp.br with LMTP; Wed, 13 Dec 2017 14:38:59 -0300 (BRT)
Received: from localhost (localhost [IPv6:::1])
by mail.pop-ba.rnp.br (Postfix) with ESMTP id 640E6AC0D7E
for <fraudes@pop-ba.rnp.br>; Wed, 13 Dec 2017 14:38:59 -0300 (-03)
X-Virus-Scanned: amavisd-new at pop-ba.rnp.br
Received: from mail.pop-ba.rnp.br ([IPv6:::1])
by localhost (mail.pop-ba.rnp.br [IPv6:::1]) (amavisd-new, port 10024)
with ESMTP id qCvhaDtJN53u for <fraudes@pop-ba.rnp.br>;
Wed, 13 Dec 2017 14:38:59 -0300 (-03)
Received-SPF: neutral (conduspar.com.br: Domain does not state whether sender is authorized to use 'jader.pinto@conduspar.com.br' in 'mfrom' identity (mechanism '?all' matched)) receiver=mail.pop-ba.rnp.br; identity=mailfrom; envelope-from="jader.pinto@conduspar.com.br"; helo=mx0.rnp.br; client-ip=200.130.35.135
Received: from mx0.rnp.br (mx0.rnp.br [200.130.35.135])
by mail.pop-ba.rnp.br (Postfix) with ESMTP id 09079AC0D6C
for <fraudes@pop-ba.rnp.br>; Wed, 13 Dec 2017 14:38:57 -0300 (-03)
Received: from mail-mtaout-proxy-01.rnp.br (mail-mtaout-proxy-01.rnp.br [200.130.35.126])
by mx0.rnp.br (8.14.4/8.14.4/Debian-8+deb8u1) with ESMTP id vBDHcvWO022469
for <fraudes@pop-ba.rnp.br>; Wed, 13 Dec 2017 15:38:57 -0200
Received: from localhost (localhost [127.0.0.1])
by mail-mtaout-proxy-01.rnp.br (Postfix) with ESMTP id C297D100CB8
for <fraudes@pop-ba.rnp.br>; Wed, 13 Dec 2017 15:38:56 -0200 (BRST)
Received: from mail-mtaout-proxy-01.rnp.br ([127.0.0.1])
by localhost (mail-mtaout-proxy-01.rnp.br [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id yj4wVVccVy5A for <fraudes@pop-ba.rnp.br>;
Wed, 13 Dec 2017 15:38:56 -0200 (BRST)
Received: from mail-mtain-02.rnp.br (mail-mtain-02.rnp.br [200.130.35.125])
by mail-mtaout-proxy-01.rnp.br (Postfix) with ESMTPS id A188B100AE8
for <fraudes@pop-ba.rnp.br>; Wed, 13 Dec 2017 15:38:56 -0200 (BRST)
Received: from mx0.rnp.br (gti-idc-fw-35.rnp.br [200.130.35.1])
by mail-mtain-02.rnp.br (Postfix) with ESMTP id A6948CE135
for <artefatos@cais.rnp.br>; Wed, 13 Dec 2017 15:38:56 -0200 (BRST)
Received: from mail.conduspar.com.br (mail.conduspar.com.br [200.195.137.2])
by mx0.rnp.br (8.14.4/8.14.4/Debian-8+deb8u1) with ESMTP id vBDHcuPw022466
for <artefatos@cais.rnp.br>; Wed, 13 Dec 2017 15:38:56 -0200
Received: from JADER
by mail.conduspar.com.br (IceWarp 11.0.0.1 x64) with ASMTP id 201712131537575130
for <artefatos@cais.rnp.br>; Wed, 13 Dec 2017 15:37:57 -0200
From: "Jader - Conduspar" <jader.pinto@conduspar.com.br>
To: <artefatos@cais.rnp.br>
References: <201712131242.vBDCgfR3025166@servidorsslx.xnssl.com.br> <004e01d37429$1930b520$4b921f60$@conduspar.com.br> <03c101d3742e$621de3c0$2659ab40$@conduspar.com.br> <00a501d37433$b79adc90$26d095b0$@conduspar.com.br>
In-Reply-To: <00a501d37433$b79adc90$26d095b0$@conduspar.com.br>
Subject: =?iso-8859-1?Q?ENC:_Notifica=E7=E3o_de_Emiss=E3o_de_Nota_Fiscal_Eletr=F4n?=
=?iso-8859-1?Q?ica_=2815158=29?=
Date: Wed, 13 Dec 2017 15:36:04 -0200
Message-ID: <040801d37438$ec0bc020$c4234060$@conduspar.com.br>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_040D_01D37428.28856120"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQFUDLkxGxvk/o5Pu7WwKE5JNB3tMwIiyo3iAOFm6dgA4USPpaQhLC7g
Content-Language: pt-br
X-CanIt-Geo: ip=200.130.35.126; country=BR; latitude=-22.8305; longitude=-43.2192; http://maps.google.com/maps?q=-22.8305,-43.2192&z=6
X-CanItPRO-Stream: base:zimbra (inherits from base:default)
X-Canit-Stats-ID: Bayes signature not available
Received-SPF: neutral (mx0.rnp.br: 200.195.137.2 is neither permitted
nor denied by domain jader.pinto@conduspar.com.br)
receiver=mx0.rnp.br; client-ip=200.195.137.2;
envelope-from=<jader.pinto@conduspar.com.br>; helo=mail.conduspar.com.br;
identity=mailfrom
X-Scanned-By: CanIt (www . roaringpenguin . com) on 200.130.35.135
X-Scanned-By: CanIt (www . roaringpenguin . com) on 200.130.35.135
Imagens
