Re: Fwd: Wire Transfer (13192NI97)

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]

VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.

Header:

From - Thu Aug 16 19:10:40 2012
X-Account-Key: account6
X-UIDL: x
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Delivered-To: x
Received: by 10.58.218.134 with SMTP id pg6csp348410vec;
Wed, 15 Aug 2012 12:55:17 -0700 (PDT)
Received: by 10.66.75.133 with SMTP id c5mr26427796paw.24.1345060516590;
Wed, 15 Aug 2012 12:55:16 -0700 (PDT)
Return-Path: <KarissaLueras@online.de>
Received: from [190.236.58.136] ([190.236.58.136])
by mx.google.com with ESMTP id uz9si4080654pbc.136.2012.08.15.12.54.48;
Wed, 15 Aug 2012 12:55:16 -0700 (PDT)
Received-SPF: neutral (google.com: 190.236.58.136 is neither permitted nor denied by best guess record for domain of
KarissaLueras@online.de) client-ip=190.236.58.136;
Authentication-Results: mx.google.com; spf=neutral (google.com: 190.236.58.136 is neither permitted nor denied by best
guess record for domain of KarissaLueras@online.de) smtp.mail=KarissaLueras@online.de
Received: from (account KarissaLueras@online.de HELO wmchrwlzri.krjomzgjbuarfgt.kr) by (CommuniGate Pro SMTP 5.0.3)
with ESMTPA id 642796154 for x; Wed, 15 Aug 2012 10:54:53 -0500
Message-ID: <x@kTQX9ggbXZ>
From: <x@gmail.com>
To: <@cybertopcops.com>
Subject: Re: Fwd: Wire Transfer (13192NI97)
Date: Wed, 15 Aug 2012 10:54:53 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0FFF_01CD7AF5.ED80F480"
X-Priority: 3
X-MSMail-Priority: Normal
Importance: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109

Body:

Dear Operator,

WIRE TRANSACTION: AC-423449305795071

STATUS: CANCELLED

You can find details in the attached file.

Please wait a moment. You will be forwarded...

Comments:

These e-mails normally have an attachment called Wire_Transfer_###.htm, When you open the attachment it redirects you to a website that attempts to infect your computer with malware. All of the samples that we investigated so far, redirected to some Russian site.

The following pages have more information about this type of malware spam:
http://tools.cisco.com/security/center/viewThreatOutbreakAlert.x?alertId=26562
http://blog.dynamoo.com/2012/08/mskoblastionlineru-malicious-spam-goes.html

Also refer to the fake Intuit.com malware spam examples.

Related Cyber Criminal Profiles:

No related profiles found.

Similar Spam Examples:

General Malware Spam - PURCHASE ORDER ENQUIRY..PLEASE CONFIRM
American Express Account Alert: A Payment Was Received Malware Spam
Useless Afrikaans Loan Offer Scam
Malware Spam - Sprint: Your bill is now available online
General Malware Spam - You have received a new fax message

Related Malware Samples:

No related malware samples found.

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]