Sunday, July 3, 2016

Lisez votre message! (Phishing Hello bank)

sur un seul site.

Votre actu des

Bonjours Cher(e) Client(e) ,

Un nouveau message est disponible sur votre messagerieo
Pour consulter, Veuiller cliquez sur le lien ce-dessous :

Accèdez à votre boite

Nous vous remercions de votre confiance.
Hello-Bankª

Ce courriel vous a été envoyé par un système automatique d'émission de messages. L'adresse d'émission n'est pas une adresse de courriel classique. Si vous écrivez à cette adresse, votre message ne sera pas pris en compte

Screenshot of the email :

Email analysis :

NOTE : servicehelloban@decathlon.fr
NOTE : www-data@decathlon.fr
NOTE : X-Php-Originating-Script : 0:noi.php
NOTE : Received : by decathlon.fr (Postfix, from userid 33)
NOTE : Received : from decathlon.fr ([139.59.145.95])


NOTE : Decathlon servers were used to relay this phishing.

Tyler Butler sent you "Scanned Documents.zip"

Tyler Butler a file with you on Dropbox

The updated agreement with BDO

Scanned Documents.zip

Download

© 2016 Dropbox

Screenshot of the email :

Email analysis :

NOTE : no-reply@dropbox.com
NOTE : User-Agent : Mozilla/5.0 (Windows NT 6.1; rv:24.0)
NOTE : Gecko/20100101 Thunderbird/24.2.0
NOTE : americanexpress@welcome.aexp.com
NOTE : 14.174.35.53


NOTE : Received : from static.vnpt.vn (unknown [14.174.35.53])

File analysis :

CLICK : Download
OPEN :

https://www.cubbyusercontent.com/pl/Scanned+Documents.zip/_08fa4c28262f424b970037c786caf840

DOWNLOAD : Scanned Documents.zip
RESULT : Scanned Documents.zip is a virus.

Virus analysis :

FILENAME : Scanned Documents.zip
SHA256 : 27d79850e1bae0d14a689e1d019ef6217d805189b04e486e3d54ed8a363d3689

====================================
Ad-Aware : Trojan.GenericKD.3363605
AegisLab : Troj.Generickd!c
Arcabit : Trojan.Generic.D335315
Avira (no cloud) : HEUR/Suspar.Gen
BitDefender : Trojan.GenericKD.3363605
DrWeb : JS.DownLoader.1225
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AGS
Emsisoft : Trojan.GenericKD.3363605 (B)
F-Secure : Trojan.GenericKD.3363605
Fortinet : JS/Nemucod.1509!tr
GData : Trojan.GenericKD.3363605
Ikarus : Trojan.Script
K7AntiVirus : Trojan ( 004dfe6d1 )
K7GW : Trojan ( 004dfe6d1 )
Kaspersky : HEUR:Trojan-Downloader.Script.Generic
McAfee : JS/Nemucod.la
McAfee-GW-Edition : JS/Nemucod.la
eScan : Trojan.GenericKD.3363605
Microsoft : TrojanDownloader:JS/Nemucod.EW
Sophos : Troj/JSDldr-PH
====================================

Extraction of the zip : 3 files extracted.
Result : Scan001.js, Scan002.js, Scan003.js

File Scan001.js
File Scan002.js
File Scan003.js

CONGRATULATIONS!!! YOU HAVE WON NATIONAL LOTTERY

UK ONLINE NOTIFICATION DESK
BRITISH GOVERNMENT ACCREDITED LICENSED!
UK NATIONAL LOTTERY
REGISTERED UNDER THE DATA PROTECTION,
(Registration No. Z720633X).

UK NATIONAL LOTTERY
TOLPITS LANE, WATFORD, HERTS WD18 9RN,
UNITED KINGDOM

(Customer Service)
Tel: 44 (0) 192 342 5000

Ref: UK/9420X2/683
Batch: 074/05/ZY369

Dear Lucky Winner,

We happily announce to you the draw (#966) of the UK NATIONAL LOTTERY online Sweepstakes International program held on 20th June, 2016. Your e-mail address attached to ticket number : 96475645 188 with Serial number 5368/02, drew the lucky numbers: 30, 3, 5, 44, 14 and 22, bonus number: 10.

CONGRATULATIONS!!!!

Due to mix up of some numbers and names, we instruct you to keep your winning information confidential until your claims has been completely processed and your winning fund is being claimed. This is part of our security protocols to avoid double claiming and unwarranted abuse of this program by some participants. You have therefore been approved to claim a total sum of GBP1,000,000 (One Million Great British Pounds Sterling Only) cash prize,credited to a file No.: KTU/9023118308/16. This is from a total cash prize of GBP10,000,000(Ten Million Great British Pounds) shared among the first Ten(10) lucky winners in this category i.e. Match 5 plus bonus. All participants for the online version were selected randomly from World Wide Websites through our computer ballot draw system extracts from over 500,000 unions, associations and corporate bodies that are listed online.This promotion takes place weekly until the end of the year 2016. In order to redeem your prize, you are expected to present your winning details :(I)Winning Numbers, (ii)Ticket Number, (iv)The File Ref. Number to the agent for verification and confirmation together with the Serial Number.

CLAIM REQUIREMENTS:

1. FULL NAME:
2. DATE OF BIRTH:
3. SEX:
4. OCCUPATION:
5. CONTACT ADDRESS:
6. TELEPHONE NUMBER:

********************************************************
UK NATIONAL LOTTERY CLAIM MANAGER
Name: Mr. Andrew M. Fernandes
Email: nationalfiduciary_claimagent@consultant.com
Tel: 44 (0) 745 218 5251
Fiduciary Agent, UK National Lottery,
********************************************************

CONGRATULATIONS FROM THE MEMBERS AND STAFF OF UK NATIONAL LOTTERY.

Yours faithfully,
Mrs. Courtney Cervantes.
Online coordinator for UK NATIONAL LOTTERY Sweepstakes International Program
NATIONAL LOTTERY.

BELOW ARE THE SPONSORS OF THIS PROGRAM

Executives:

Dr. P. Swier (CEO), Mr. Gerald Goodman (Manager Foreign Operations), Mr. Franklyn Van Der Weijden (Manager Domestic Banking Operations), Dr. James Williams (Director International Credit Department), Mrs. Lonni K. Anderson (Legal Representative), Mrs. Lyudmyla Marchukova (Regional Manager), Mr. Stephen Boer (Chairman), Mr. Chris Moritz(International Relation Officer). Mrs. Lonni K. Anderson (Legal Representative), Mrs. Lyudmyla Marchukova (Regional Manager), Mr. Stephen Boer (Chairman), Mr. Chris Moritz(International Relation Officer).

Email analysis :

NOTE : uknationallotto@post.com
NOTE : uknationallotto@national-lottery.co.uk
NOTE : Received : (from vu2004@localhost)
NOTE : by hosting.datacenter.loc (8.13.8/8.13.8/Submit)
NOTE : 190.66.7.136

Partnership request...

Hello,

I want to come and establish in your country with some money but I need someone to partner with.

Could you please respond for more details?

Thanks.

Jewel.

Email analysis :

NOTE : jewelgoodness@outlook.com
NOTE : amsiwmmw@aol.com
NOTE : Received : from ADMIN-PC (unknown [108.163.240.14])

Good day

Dear Friend,Good day,i am contacting you in respect to my late husband's money ,Once i receive your positive response, i will give you more details.

Mrs Recheal Nana Essien

Email analysis :

NOTE : Good day
NOTE : mrsrnesien@live.fr
NOTE : recheal_essien@aol.com
NOTE : Received : from MICROTIQUE-PC (unknown [85.13.253.153])


NOTE : by mtaout-mbe01.mx.aol.com (MUA/Third Party Client Interface)

Abu Dhabi Fund for Development (ADFD)

Dear Sir,

We are seeking the attention of investors, project owners and general business facilitators for possible collaboration through project development and the actualization of viable investment initiatives globally.

Abu Dhabi Fund for Development (ADFD) focuses on number of areas in which it has developed significant competitive advantage, including acquisitions, aerospace/aviation, telecommunication, technology, energy, industry, health care, infrastructure, real estate, hospitality and service ventures. Abu Dhabi Fund for Development (ADFD) is a catalyst for the economic diversification of Abu Dhabi; established and owned by the Government of Abu Dhabi, the organization's strategy is built on the management of Long-term, capital-intensive investments that deliver strong financial returns and tangible social benefits for the Emirate. ADFD brings together and manages a multi-billion dollar portfolio of the government of Abu Dhabi which we wish to re-invest in project financing and investments in viable ventures on a 2.5% interest rate loan per annum on long term investment projects that can generate up to 10% ROI within the period of the sanctioned loan.

We invite all interested project owners and investors - UAE or non- UAE to contact the undersigned for further information on procedures for consideration.

Kind regards,

Fares Mansour
Director for Global Investment Initiative
Abu Dhabi Fund for Development (ADFD)
Al Bahar Towers, King Abdullah bin Abdulaziz Al Saud Street
P .O. Box 814, Abu Dhabi, U.A.E

Email analysis :

NOTE : khalifamohammeduae@hotmail.com
NOTE : Received : from SNT148-W56 ([65.55.90.9])


NOTE : client-ip=65.55.90.29;
NOTE : Mime-Version : 1.0

SUBJECT: YOU HAVE A PARCEL FOR DELIVERY FROM THE WORLD BANK.?

United Parcel Service,
70 Evo Road
GRA Phase II
Port Harcourt, Rivers
Nigeria
Phone number: +2348162029357

Dear Beneficiary,

SUBJECT: YOU HAVE A PARCEL FOR DELIVERY FROM THE WORLD BANK.

This is to officially notify you that your long overdue payment has been released as a result of the World bank, United Nation and the FBI intervention.
The sum of 10,000,000.00 USD (Ten Million United State Of American Dollars) has been approved for you by the World bank and ready to be remitted to your via an Automated Teller Machine Card to be delivered to you by us the United Parcel Service. Your payment will be remitted to you via an Automated Teller Machine Card issued by MORGAN CHASE BANK and powered by Master card, with a daily withdrawal limit of 10,000 USD. It was also decided that you will send the sum of 259 USD for your Automated teller machine card activation and 230 USD for the shipment of your ATM Card, total amount to pay is 489 usd. Your Automated Teller Machine card is presently in our office for processing and ready for shipment to your address. Kindly confirm your name, address, phone number, scan copy of valid identity card to this email address ezepaul312@gmail.com. As soon as you confirm your address, payment details will be sent to you so you can remit the 489 USD so we can dispatch your ATM card.

You can call paul on : +2348162029357 for details.

We await your swift reply as we have 72 hours to dispatch your ATM card.

Thank you.

Best regards,
Mr paul
UPS NIGERIA
ezepaul312@gmail.com
Phone number: +2348162029357

Email analysis :

NOTE : ezepaul312@gmail.com
NOTE : sssss.hhhh@aol.fr
NOTE : Received : from USER-PC (unknown [197.211.53.30])


NOTE : by mtaout-aad01.mx.aol.com (MUA/Third Party Client Interface)

Salam Hasan

Do you have ATM cash machine in your country?

Hello Dear,

How are you today, i am your friend from Burkina Faso. Can you use ATM Visa card to withdraw money on ATM cash machine in your country?. i want to transfer money to you from my country, it is the part of the money taken by the old politician newly forced out of power. i will change the account to your name and apply for a visa card with your name in our bank, i will send the visa card to you and you will be withdrawing money with it and always send my own percentage of the money. whenever you withdraw money you will send 50% to me and you will take 50% of the money. the visa card and the bank account will be on your name, there is no any risk involve, i assure you will never get into problem. I will be waiting for your information as soon as possible.

Your name...........................................
Age.................................................
Sex.................................................
Country.............................................
Occupation..........................................
Phone number........................................

Best Regards.
Salam Hasan.
+226 79134016

Email analysis :

NOTE : salamhasan116@gmail.com
NOTE : salamhasan114@gmail.com
NOTE : Received : from [154.66.171.50] (port=44864 helo=[10.80.204.71])
NOTE : by mail1.alpha.hostsg.com with esmtpa

ideal1

Attention

We have deposited the check of your fund (8,500 000.00USD) through Western Union department after our finally meeting regarding your fund, All you will do is to contact Western Union director Mr Dan Ike. He will give you direction on how you will be receiving the funds daily.Remember to send him your Full information to avoid wrong transfer such as,

Receiver's Name:_______________
Address: ________________
Country: _____________
Phone Number: _____________

Though, Mr Dan Ike has sent $5000 in your name today so contact Mr Dan Ike as soon as you receive this email call +22998492837 or (info.westernunion1@post.cz)and tell him to give you the Mtcn, sender name and
question/answer to pick the $5000 Please let me know as soon as you received all your fund,

Best Regards.
Mr Rorbert Roy

Email analysis :

NOTE : info.westernunion1@post.cz
NOTE : ideal1@qatar.net.qa
NOTE : Received : from [82.148.101.116]


NOTE : (Forwarded-For: 197.234.219.92)

Rép : Urgent Response

My name is Jones Kunene a legal practitioner based in Johannesburg and the personal attorney to late Mr. Randolph Marriott, a Foreign National who died along with his wife and two sons in a robbery attack in their farm settlement home in Johannesburg, South Africa. My client was a successful and an accomplished family man who made enough fortune before his untimely death. Since then I have made several inquiries through his Embassy to locate any of his extended relatives but this exercise has proved unsuccessful. After several unsuccessful attempts, I decided to trace his relatives to locate any member of his family, not much progress was recorded.

Mr. Randolph Marriott was an influential wealthy businessman, a diamond magnet here in Johannesburg and he left behind a deposit of Fourteen Million, Five Hundred Thousand United States Dollars (USD$14.500, 000.00USD) in his domiciliary bank account in a commercial bank here in South Africa. After the death of Randolph Marriott, his bankers contacted me as his attorney to provide his next of kin who should inherit his funds. The board of directors of his bank adopted a resolution and I was mandated to provide his next of kin for the payment of these funds or forfeit the money to the bank as an abandoned property. The bankers had planned to invoke the abandoned property decree of 1996 to confiscate the funds after the expiration of the period given to me.

Fortunately, in the verge of my search, I came across your name through a consultancy firm in your Chamber of Commerce & Industry that provided me with your reputable data. Being convinced that you might provide clue to my search. I therefore decided to contact you with these facts before me because of the similarities. By virtue of my closeness to the deceased and his immediate family, I am very much aware of my client’s financial standing and the bank account he operates.

I have reasoned very professionally and I feel it will be legally proper to present you as the next of kin to my deceased client, so that you can be paid the funds left in his bank account. I therefore seek your consent to present you as the next of kin to the deceased since you are at an advantage. The proceeds of this bank account valued at USD$14.5Million US Dollars can be paid to you. We shall both share the funds equally, 50% for me and 50% to you. I shall assemble all the necessary legal documents that will be used to back up our claim. All I require is your honest cooperation to enable us seeing the deal through.

NOTE: PLEASE GET IN TOUCH WITH ME BY EMAIL FOR PRIVACY AND CONFIDENTIALITY TO ENABLE US DISCUSS FURTHER Tel: + 27 840 142 450 (joneskunene@webmail.co.za) or (joneskunene@hotmail.com)

I guarantee that this will be executed under a legitimate arrangement that will protect you from any breach of the law.

Yours Sincerely,
Jones Kunene Attorney

Email analysis :

NOTE : joneskunene@webmail.co.za
NOTE : no.reply@drkhalid.co.uk
NOTE : Received : from User ([223.197.230.165])

CONTACT Mrs. JENNIFER JOHNSON FOR YOUR ATM CARD

ATTN; DEAR,

This is Mrs. JENNIFER JOHNSON , I have registered your ATM CARD to the POST OFFICE BENIN REPUBLIC so that they will Post it to your home address and I believe your current address is still the same. Your total amount in the envelope is $4.8 Million USD and the POST OFFICE assured me that there will be no stoppage until it get to your hand. I want you to contact them and re-confirm your address where to Post it.

Contact Mr. John Ben,
03 BP 1000,COTONOU
BENIN REPUBLIC.
E-mail: (postofficefile1@gmail.com)
Telephone +229 99338054
Your full information for the Postal.

FULL NAME: ==============
COUNTRY: ==============
CITY: ==============
CURRENT HOME ADDRESS: ===========
TELEPHONE/CELL PHONE NUMBER.=========
AGE/OCCUPATION: =============
SEX/A COPY OF YOUR IDENTIFICATION: ===============

the manager, informed me that it will take good 3 days to get to your house and your Envelope accumulate. Your Current address has to be reconfirmed when contacting the post office. Call me at +229 99338054 as soon as you receive your Envelope.

Thanks & remain blessed.
Mrs.JENNIFER JOHNSON

Email analysis :

NOTE : www.@skyblue.ocn.ne.jp
NOTE : postofficefile1@gmail.com

FBI LETTER[CODE:210]f[[

JAMES BRIEN COMEY
EXECUTIVE DIRECTOR FBI
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON D.C FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP

The Federal bureau of investigation (FBI) Washington,D.C in conjunction with some other relevant Investigations Agencies have recently been informed through our Global intelligence monitoring network that your over-due contract payment which was fully endorsed in your favor accordingly by the Central bank of Malaysia(Bank Negara Malaysia) has not been claimed. It might interest you to know that we have taken out time in screening through this project as stipulated on our protocol of operation and have finally confirmed that your contract payment is 100% genuine and hitch free from all facet and of which you have the lawful right to claim your fund without any further delay. We further advise that you go ahead in dealing with the Central Bank office accordingly as we will be monitoring all their services with you as well as your correspondence at all level.

We were also made to understand that a lady with name Mrs. Joan C.Bailey from OHIO has already contacted them and also presented to them all the necessary documentation evidencing your claim purported to have been signed personally by you prior to the release of your contract fund valued at about $25million us dollars only but the Central Bank office did the wise thing by insisting on hearing from you personally before they go ahead on wiring your fund to the Bank information which was forwarded to them by the above named Lady so that the main reason why they contacted us so as to assist them in making the investigation. Contact immediately the office of the Central Bank of Malaysia (Bank Negara Malaysia) via email with the below information accordingly:

NAME: Dr. Zeti Akhtar Aziz.
OFFICE ADDRESS: Bank Negara Malaysia,
Jalan Kuching, Kuala Lumpur,
Wilayah Persekutuan,Kuala Lumpur,
Selangor,Malaysia
Email: zeti.aziz@aol.com

Meanwhile, we will advise that you contact the office of the Governor of the Central Bank immediately with the above email address and request that they attend to your payment file as directed, so as to enable you receive your contract fund accordingly. To this effect, you are required to reconfirm and authenticate your given particulars below for certainty and onward processing and release of you funds as we may not be held liable for any wrong payment.

FULL NAMES: __________________________________
CITY: _________________________
STATE: __________________________________
ZIP: ______________
COUNTRY________________________________
SEX: _______________
AGE: __________________
TELEPHONE NUMBER: _____________________
FAX: __________________________

Ensure you follow all their procedure as may be required by them as that will further help hasten up the whole procedure as regard to the transfer of your fund to you as designated. Also have in mind that the Central Bank of Malaysia equally have their own protocol of operation as stipulated on their banking terms, so delay could be very dangerous. Thank you very much for your anticipated co-operation in advance as we earnestly await your urgent response to this matter.

Best Regards,

James Brien Comey
Federal Bureau of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue,
NW Washington, D.C.

Email analysis :

NOTE : zeti.aziz@aol.com
NOTE : fb@fb.com
NOTE : 162.214.6.66 (mail.arcigee.com)
NOTE : Received : from [13.84.155.162] (port=2019 helo=User)


NOTE : by mail.arcigee.com

Hello Beloved

Dear beloved,

Good day my beloved one, I am writing you these massage to you with tears and sorrow from my heart. I am by name Miss Tience, a 23 years old girl from Kenya, My Mother was Late Mrs Lorna Laboso the former Kenyan Assistant Minister of Home and affairs who was among the plan that crash in a remote area of Kalong s western Kenya. The plane crashed occurred on Tuesday 10th, June, 2008. read more about the crash with the below web site.

http://edition.cnn.com/2008/WORLD/africa/06/10/kenya.crash/index.html

After the burial ceremony of my mother my stepmother and my uncles conspired and sold my mother s properties to an Expert rate in Switzerland and shared the money among themselves and left nothing for me because my father died when I was three years; One faithful morning, I opened my mother's briefcase and found out a document that my mother deposited a huge amount of money in UNITED BANK FOR AFRICA UBA/BIB bank Burkina Faso with my name as the next of kin.

After then I visit Burkina Faso to withdraw the money for a better life so that I can take care of myself and start a new life, on my arrival over there, the Bank Director whom I meet in person told me that my mother left an instruction to the bank, that the money should be release to me only when I am married or I present a trustee who will help me and invest the money overseas. That is the reason why I am in search of a honest and reliable person who will help me and stand as my trustee for the Bank to transfer the money to his bank account.

I will like you to help me to relocate to your country because my stepmother has threatened to assassinate me once she knows my were about. The amount is($8.4 M USD) eight point four million United State Dollars, I have confirmed from the bank in Burkina Faso, You will also help me to put the money in a more profitable business venture in your Country.
However, you will help me by recommending a nice University in your country so I can complete my studies. It will be my pleasure to compensate you with 30% of the total money for your services and the balance shall be my capital, with your kind idea for me to invest under your control over there in your country.

As soon as I receive your positive response showing your interest I will put things in order immediately.I shall appreciate an urgent message indicating your ability willingness to handle this transaction trustfully and sincerely. I thank God Today that I am out from my country (KENYA) right now In (Burkina Faso) where my mother deposited the money with my name as the next of kin, and I have confirmed from the bank with the Documents I have at hand which I will be sending to you after receiving a good respond from you,

I will also be sending to you my picture's in my next mail, thanks and have a nice day.
Sincerely yours

Miss Tience.

Email analysis :

NOTE : misstiencelorna@gmail.com
NOTE : Mime-Version : 1.0
NOTE : X-Yahoo-Newman-Property : ymail-5

Make Profit Daily

Hello,

Its as simple as it sounds. Sports betting has become widely accepted and very productive especially when you get the right tips and make the right predictions. Am one sports analyst with a very special and rare talent for making accurate sport predictions and trust me,with my tips and predictions,you'll certainly make profits 5 days in a week,and thats me being modest.

My proposal is simple. My predictions are mostly about soccer and i've been able to help thousands of people make substantial progress as far as their finances are concerned.

This is no scam.

All you need to do is register with an online sports betting site. I'll give you a double-your-money odds and you play the games and get double your stake the next day. If for example you stake 100 usd,you get 200 usd the next day. The amount you stake is strictly at your discretion. Its really that simple.

Whats in it for me?

I'ld be lying if i say am not in this for the money. But am not in it for your money,trust me. Reply this message and my first odds for you is completely on the house. If you choose to continue,then i'll continue to give u GUARANTEED daily odds at a fixed rate,depending on how many odds you want. Believe me,some of my clients request for over 5+ odds. Yes, 5+. Remember that 100 usd? Meaning it automatically becomes 500 usd the next day,provided you play with my tips/predictions. And the security involved is you only get to pay me after you get your winnings from your preferred betting company. So the payment is more like an appreciation.

So lets make some money. You stand to lose nothing by ignoring this message,you gain a lot if you reply.

Predictiongenius88@gmail.com

Soccer Prediction Genius.

Email analysis :

NOTE : predictiongenius88@gmail.com
NOTE : Soccerpredictiongenius@mail.com
NOTE : Received : from h2379245.stratoserver.net ([85.214.84.244]:59111 helo=User)