Sunday, August 31, 2014


PHONE: +234 903 363 9491
FAX: 234 674 478 8273


Am David Morise, director cash processing unit, united bank for Africa [UBA the only bank appointed by the A.U. Members lead by President Mohamed Ould Abdel Aziz . Because of the frauds going on in West Africa countries where some innocent beneficiaries were asked to pay in advance before receiving their money owed to them. The above Africa union held meeting in Nigeria and resolve to pay all beneficiaries in cash through means of diplomatic courier service. We receive your files from international monetary fund (I.M.F.) as one of the beneficiaries. Take note:Three thousand united state dollars (usd$3,000)have been mapped out for all expenses in taxes and other doccumets that matters. Therefore, I want you to bear it in mind that your total fund will not beOne million five hundred thousand united state dollars ($1.500,000.00) but One million four hundred and ninety seven thousand united state dollars ($1.497,000.00). If anybody tells you that he is paying you in bank draft or telegraphic money transfer both western union and money gram, do not listen to him or her because due to this frauds no international bank honors our remittance instruction any more that is why we settled to pay in cash through courier. We also received a security report that you paid the fraudsters who have been deceiving you, telling you that they are going to send this money to you. Dear as a senior banker, controlling this cash payment now, I advise you not to waste your money by paying any body in advance again, and if you just follow my instruction, you will receive your money in three days time. Your fund will now be packaged in box and take to the diplomatic courier service for immediate shipment, I will also send the picture of the box by attachment to you to see how the money is packed, and I will send you more mails to give you more information for you to know the genuineness of this transaction. Therefore, do forward your home address and direct phone number to this E-Mail ( )( ) All the documents will be sent to you if I am assured that you have stopped sending money to those fraudsters.

Am waiting to hear from you with the required information of yours.

David Morise
Director cash processing unit
united bank for Africa. (U.B.A).


NOTE : Received : from (

NOTE : Received : from [] ([])

NOTE : (authenticated bits=0) by (8.14.4/8.14.4)

NOTE : Cité Soummam - Poste 5 juillet 16024 BAB EZZOUAR
NOTE : tél / Fax: 021 24 20 54

H&C Stone, your best stone supplier!

Dear Manager Director,

Thanks for taking time out from your busy schedule to read my email. This is Rita from H&C Stone. I am writing to you in the hope of establishing long-term business relations with you.

We are a professional stone company and have been doing business with a lot of clients from many countries for nearly a decade. We have various kinds of granite and marble. Our products cover fireplace, headstone, carving and so on. Custom-make is our business model and all kinds of need for customized work will be meet. If you are interested in our products, please contact us at any time. Hope to hear good news from you. We thank you very much for your attention and look forward to your reply soon.

Yours sincerely,

H&C Stone Co., Ltd.
Unit 202, #93, International Village,
Jinshan West Road, Huli District,
Xiamen 361009, China
Tel: 0086 592 555 3179


Dear Sir/Madam,

I am JERRY MAYAKI the director in-charge of auditing and accounting section of commercial bank in Nigeria West Africa with due respect and regard. I have decided to contact you on a business transaction that will be very beneficial to both of us at the end of the transaction. During our investigation and auditing in this bank, my department came across a very huge sum of money belonging to a deceased person who died on November 2012 in a plane crash and the fund has been dormant in his account with this bank without any claim of the fund in our custody either from his family or relation before our discovery to this development.

Although personally, I keep this information secret within myself and my partners to enable the whole plans and ideas be profitable and Successful during the time of execution. the said amount was US$ 14M(fourteen million Dollars).United States Meanwhile,all the whole arrangements to put claims over this fund as the bonafide next of kin to the deceased, get the required approval and transfer this money to a foreign account has been put in place and directives and needed information will be relayed to you as soon as you indicate your interest and willingness to assist us and also benefit yourself to this great business opportunity.

In fact I could have done this deal alone but because of my position in this country as a civil servant,we are not allowed to operate a foreign account and would eventually raise an eye brow on my side during the time of transfer because I work in this bank.this is the actual reason why it will require a second party or fellow who will forward claims as the next of kin with affidavit of trust and oath to the bank and also present a foreign account where he will need the money to be re-transferred into on his request as it may be after due verification and clarification by the correspondent branch of the bank where the whole money will be remitted from to your own designated bank account. I will not fail to inform you that this transaction is 100% risk free. On smooth conclusion of this transaction,you will be entitled to 30% of the total sum as gratification, while 10% will be set aside to take care of the expenses that may arise during the time of transfer and also telephone bills,while 60% will be for me and my partners.Please,you have been advised to keep top secret as we are still in service and intend to retire from service after we conclude this deal with you.

I will be monitoring the whole situation here in this bank until you confirm the money in your account and ask us to come down to your country for subsequent sharing of the fund to percentages previously indicated and further investment,either in your country or any country you advice us to invest in. All other necessary information will be sent to you when I hear from you. I suggest you get back to me as soon as possible stating your wish in this deal.

Yours faithfully,



New York,
NY 10017 ,

We are currently disbursing loans to firm and individual, who are in need of funding, and our loan scheme qualifies every one regardless of their credit record, and as a matter of fact, your loan application is going to be reviewed with utmost importance.Contact us for a Secured loan offer at 0.2% interest rate for all individuals or company with or without security, and irrespective of your credit rating.

Our service offers:
Loans from ? 5,000 GBP to ?500,000 GBP
Reimbursement of 3 months to 20 years
CCJ, arrears, adverse credit history all accepted
Low interest rates from 0.2% APR
Instant Decision
Same-day subscription
Loans processed in 72 hrs

To apply, simply send an email to:


NOTE : Received : from unknown (HELO (

NOTE : Received : from unknown (HELO ? (

You are to stop further dealings with any other office.

Attn: Beneficiary ,

Truth of the Matter.

I am compelled to write you in respect of your fund remittance, which transfer has remained unsuccessful. I am very sure that you must have lost hope of ever getting your fund transfer released especially after all the frustrations, endless disappointment and broken promises in the hands of some officials.

Based on all these and also the problems that we are having with the IMF and the FBI,with transfer of over $5.5m usd.After our meeting last week We have decided to pay you in cash through a diplomatic means.The money will be delivered to your door step in your country.

Below are required information,s need.

1. Full Names:.............................
2. Contact Address:.......................
3. Direct Telephone Number:.................

NB: You are to stop further dealings with any other office to achieve your goal.

Yours sincerely,
Dr Williams Paul
Tel: +234-81701-99940.

Mr Ray Walter


How are you? hope all is well with you and your family. I know that you might have forgotten about this your outstanding fund due to delaying the delivery up till now. I am writing to inform you that your file was found in our office today and we discovered that your cheque of $6.6 Million united state dollars have not been sent to you as it was instructed by our late boss Mrs. Victoria Ray. We are very sorry for the mistake and the delaying, please bear with us because the fault is from our former secretary who did not complete the instruction giving by our woman. Note that your cheque has been convert into Master ATM Card to free it from Expiring. This is to inform you that the arrangement have made to deliver the $16.6 Million through ATM CARD to you the meeting is concluded last. Your ATM CARD is well packaged with everything legal documents to cover it not having any problem with any Office Authority and we have waiting to hear from you since to deliver it to your home as soon as you contact us with you current information.

(1.) Your Full name,________________
(2.) Your home Address,______________
(3.) Your current telephone number,_________
(4.) A copy of your picture,_____________
(5.) Your age/sex,____________________
(6.) Your country,________________________
(7.) Your occupation,__________________

Therefore you should contact us now to avoid wrong delivery, after some days,you should contact the ATM Center Director on this below E-mail(

Contact Person; Dr. Oscar Christopher
Tel: Phone Number; +229-6894 3553

Please try to call him immediately to know when Your ATM CARD will be deliver to you. I wait for your update as soon as you have receive your ATM CARD Package immediately.

God Bless You.
Yours sincerely

Mr Ray Walter

my new photo ;) (Virus)

my new photo ;)
if you like my photo to send me u photo

< >

Virus Analysis :

AVG SHeur4.CBFB 20140830
AVware Trojan.Win32.Generic!BT 20140830
Ad-Aware Trojan.Agent.BEZQ 20140830
AntiVir TR/Dropper.VB.18514 20140830
Avast Win32:Trojan-gen 20140830
BitDefender Trojan.Agent.BEZQ 20140830
ByteHero Virus.Win32.Heur.p 20140830
Cyren W32/Trojan.OVUX-2230 20140830
DrWeb BackDoor.Tishop.122 20140830
ESET-NOD32 Win32/TrojanDownloader.Zurgop.BK 20140830
Emsisoft Trojan.Agent.BEZQ (B) 20140830
F-Secure Trojan.Agent.BEZQ 20140830
GData Trojan.Agent.BEZQ 20140830
Ikarus Trojan.Inject 20140830
Kaspersky Trojan.Win32.Inject.qtsd 20140830
Malwarebytes Spyware.Zbot.ED 20140830
McAfee Dropper-FLO!01BD3D688F14 20140830
McAfee-GW-Edition Dropper-FLO!01BD3D688F14 20140830
MicroWorld-eScan Trojan.Agent.BEZQ 20140830
Sophos Troj/VB-HOC 20140830
Symantec Trojan.Smoaler 20140830
VIPRE Trojan.Win32.Generic!BT 20140830

ASM DLL Analysis :

; Imports from SHELL32.DLL
00401000 F4 hlt ; XREF=0x4010ae
00401001 db 0x0e
00401002 db 0x91
00401003 db 0x73
00401004 0000 add byte [ds:eax], al
00401006 0000 add byte [ds:eax], al

; Imports from NETAPI32.DLL
00401008 dd 0xffffffff ; XREF=0x4010a8
0040100c 0000 add byte [ds:eax], al
0040100e 0000 add byte [ds:eax], al

; Imports from MSVBVM60.DLL
00401010 dd 0x7294a1bb ; XREF=0x40109c
00401014 dd 0x72a0e0f7 ; XREF=0x40108a
00401018 dd 0x72a26fe2 ; XREF=0x401090
0040101c dd 0x72a2702f ; XREF=0x401096
00401020 dd 0x72a09b74 ; XREF=0x4010c0
00401024 dd 0x7294a0fd ; XREF=0x401060
00401028 dd 0x72a09b87 ; XREF=0x4010c6
0040102c dd 0x72a09a85 ; XREF=0x4010ba
00401030 dd 0x72a247df ; XREF=0x4010b4
00401034 dd 0x72a28fe9 ; XREF=0x401066
00401038 dd 0x72a3d05d ; XREF=0x4010cc
0040103c dd 0x72a1c85d ; XREF=0x401084
00401040 dd 0x72a1de99 ; XREF=0x401078
00401044 dd 0x72a14275 ; XREF=0x401072
00401048 dd 0x72a161f8 ; XREF=0x4010a2
0040104c dd 0x729435a4 ; XREF=0x4010d2
00401050 dd 0x72a26d9a ; XREF=0x40106c
00401054 dd 0x72a11c93 ; XREF=0x40107e