WitFoo-Artifact ::: action=block ::: message={"spamScore":0,"phishScore":0,"threatsInfoMap":[{"threatID":"8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa","threatStatus":"active","classification":"phish","threatUrl":"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa","threatTime":"2023-02-09T12:17:19.000Z","threat":"https://cm.naukri.com/?redirect=https%3A%2F%2Fevuuy1.codesandbox.io?ga=YmZhdXN0aW5vQGNhbHByaXZhdGUuYmFuaw==","campaignID":null,"threatType":"url"}],"messageTime":"2023-02-09T12:16:26.000Z","impostorScore":0,"malwareScore":0,"cluster":"oscorp_hosted","subject":"­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979","quarantineFolder":"Quarantine","quarantineRule":"inbound_spam","policyRoutes":["default_inbound"],"modulesRun":["av","zerohour","dkimv","spf","spam","dmarc","pdr","urldefense"],"messageSize":12296,"headerFrom":"\"Calprivate\" <leticiaandrade@sedam.ro.gov.br>","headerReplyTo":"<olgal_mkt@jaimetorres.net>","fromAddress":["leticiaandrade@sedam.ro.gov.br"],"ccAddresses":[],"replyToAddress":["4dc55a33fd232724c1e2714b70b38ee0@jaimetorres.net>"],"toAddresses":["bfaustino@oscorp.bank"],"xmailer":null,"messageParts":[{"disposition":"inline","sha256":"81c2ca8edcb5a57bc6e497c92ade977dec5b86a7e8b502cb006d4dca66d00603","md5":"6682aa92a4f412a6caa71343f3bf79be","filename":"text.html","sandboxStatus":null,"oContentType":"text/html","contentType":"text/html"},{"disposition":"attoscorped","sha256":"cc73434f1f59dcc971107968de4617b26f65e5ee1f5d9cd13ed7a3d6b265ff31","md5":"a21c383beb1805d65b1311a41cb8f90a","filename":"2333454msn.png","sandboxStatus":null,"oContentType":"image/png","contentType":"image/png"},{"disposition":"inline","sha256":"8f645fb4c28779ada8d3368fe378d97a319fb3861ee498d8620aa1d3095d9c65","md5":"c6d6840ff102727aba6f6b9684274586","filename":"text.txt","sandboxStatus":null,"oContentType":"text/plain","contentType":"text/plain"}],"completelyRewritten":false,"id":"afe6ec3c-ef90-8eab-bf23-2709176eab52","QID":"3nhm41hheh-1","GUID":"ygTGToFoxPqfWG17n-EcYfUj-gTL2hYW","sender":"leticiaandrade@sedam.ro.gov.br","recipient":["bfaustino@oscorp.bank"],"senderIP":"9.157.254.70","messageID":"<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br>"} ::: fileHash=<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br> ::: fileName=from: leticiaandrade@sedam.ro.gov.br subj: ­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979 ::: serverIP=9.157.254.70 ::: emailFrom=leticiaandrade@sedam.ro.gov.br ::: created_at=2023-02-09T12:16:26.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=­S­e­c­u­r­­e M­e­s­s­a­g­e­: 2OL6OF1A/1782214979 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-02-09T12:16:26.000Z ::: emailSendingServer=9.157.254.70 ::: pipelineEntrypoint=dispatch
{
    "emailsubject": "\u00adS\u00ade\u00adc\u00adu\u00adr\u00ad\u00ade M\u00ade\u00ads\u00ads\u00ada\u00adg\u00ade\u00ad: 2OL6OF1A/1782214979",
    "senderhost": "localhost",
    "severitylabel": "critical",
    "starttimeutc": "2023-02-09T12:16:26.000Z",
    "tags": [
        "proofpoint_protect",
        "email_protection_event"
    ],
    "productids": [
        32,
        0
    ],
    "filename": "from: leticiaandrade@sedam.ro.gov.br subj: \u00adS\u00ade\u00adc\u00adu\u00adr\u00ad\u00ade M\u00ade\u00ads\u00ads\u00ada\u00adg\u00ade\u00ad: 2OL6OF1A/1782214979",
    "severitycode": 2,
    "message": "WitFoo-Artifact ::: action=block ::: message={\"spamScore\":0,\"phishScore\":0,\"threatsInfoMap\":[{\"threatID\":\"8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa\",\"threatStatus\":\"active\",\"classification\":\"phish\",\"threatUrl\":\"https://threatinsight.proofpoint.com/4a6c87e3-5385-8727-3248-aa120bda900c/threat/email/8fd3728893e3b870853ee316a47d61eeb8120ce0c0789639391e43832a6e08fa\",\"threatTime\":\"2023-02-09T12:17:19.000Z\",\"threat\":\"https://cm.naukri.com/?redirect=https%3A%2F%2Fevuuy1.codesandbox.io?ga=YmZhdXN0aW5vQGNhbHByaXZhdGUuYmFuaw==\",\"campaignID\":null,\"threatType\":\"url\"}],\"messageTime\":\"2023-02-09T12:16:26.000Z\",\"impostorScore\":0,\"malwareScore\":0,\"cluster\":\"oscorp_hosted\",\"subject\":\"\u00adS\u00ade\u00adc\u00adu\u00adr\u00ad\u00ade M\u00ade\u00ads\u00ads\u00ada\u00adg\u00ade\u00ad: 2OL6OF1A/1782214979\",\"quarantineFolder\":\"Quarantine\",\"quarantineRule\":\"inbound_spam\",\"policyRoutes\":[\"default_inbound\"],\"modulesRun\":[\"av\",\"zerohour\",\"dkimv\",\"spf\",\"spam\",\"dmarc\",\"pdr\",\"urldefense\"],\"messageSize\":12296,\"headerFrom\":\"\\\"Calprivate\\\" <leticiaandrade@sedam.ro.gov.br>\",\"headerReplyTo\":\"<olgal_mkt@jaimetorres.net>\",\"fromAddress\":[\"leticiaandrade@sedam.ro.gov.br\"],\"ccAddresses\":[],\"replyToAddress\":[\"4dc55a33fd232724c1e2714b70b38ee0@jaimetorres.net>\"],\"toAddresses\":[\"bfaustino@oscorp.bank\"],\"xmailer\":null,\"messageParts\":[{\"disposition\":\"inline\",\"sha256\":\"81c2ca8edcb5a57bc6e497c92ade977dec5b86a7e8b502cb006d4dca66d00603\",\"md5\":\"6682aa92a4f412a6caa71343f3bf79be\",\"filename\":\"text.html\",\"sandboxStatus\":null,\"oContentType\":\"text/html\",\"contentType\":\"text/html\"},{\"disposition\":\"attoscorped\",\"sha256\":\"cc73434f1f59dcc971107968de4617b26f65e5ee1f5d9cd13ed7a3d6b265ff31\",\"md5\":\"a21c383beb1805d65b1311a41cb8f90a\",\"filename\":\"2333454msn.png\",\"sandboxStatus\":null,\"oContentType\":\"image/png\",\"contentType\":\"image/png\"},{\"disposition\":\"inline\",\"sha256\":\"8f645fb4c28779ada8d3368fe378d97a319fb3861ee498d8620aa1d3095d9c65\",\"md5\":\"c6d6840ff102727aba6f6b9684274586\",\"filename\":\"text.txt\",\"sandboxStatus\":null,\"oContentType\":\"text/plain\",\"contentType\":\"text/plain\"}],\"completelyRewritten\":false,\"id\":\"afe6ec3c-ef90-8eab-bf23-2709176eab52\",\"QID\":\"3nhm41hheh-1\",\"GUID\":\"ygTGToFoxPqfWG17n-EcYfUj-gTL2hYW\",\"sender\":\"leticiaandrade@sedam.ro.gov.br\",\"recipient\":[\"bfaustino@oscorp.bank\"],\"senderIP\":\"9.157.254.70\",\"messageID\":\"<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br>\"} ::: fileHash=<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br> ::: fileName=from: leticiaandrade@sedam.ro.gov.br subj: \u00adS\u00ade\u00adc\u00adu\u00adr\u00ad\u00ade M\u00ade\u00ads\u00ads\u00ada\u00adg\u00ade\u00ad: 2OL6OF1A/1782214979 ::: serverIP=9.157.254.70 ::: emailFrom=leticiaandrade@sedam.ro.gov.br ::: created_at=2023-02-09T12:16:26.000Z ::: streamName=proofpoint_protect ::: vendorCode=blocked_message ::: messageType=email_protection_event ::: emailSubject=\u00adS\u00ade\u00adc\u00adu\u00adr\u00ad\u00ade M\u00ade\u00ads\u00ads\u00ada\u00adg\u00ade\u00ad: 2OL6OF1A/1782214979 ::: pipelineName=proofpoint_protect ::: severityCode=2 ::: startTimeUTC=2023-02-09T12:16:26.000Z ::: emailSendingServer=9.157.254.70 ::: pipelineEntrypoint=dispatch",
    "sensitivity": "normal",
    "emailsendingserver": "201.2.96.71",
    "messagetype": "email_protection_event",
    "emailfrom": "leticiaandrade@sedam.ro.gov.br",
    "sourceinfo": "unknown",
    "filehash": "<202309021508113BF6AF47DB$48FE390D30@sedam.ro.gov.br>",
    "vendorcode": "blocked_message",
    "action": "block",
    "streamName": "proofpoint_protect",
    "serverIP": "9.157.254.70"
}