Friday, November 3, 2017

DHL Shipment Notification (Phishing)

Dear customers,

A package is coming your way through DHL Express, shipment is on transit and ready for tracking. You can request for tracking details .
Sender Account ending-> *****04291
For full tracking information please click here and follow the process.
Kindly keep the downloaded documents safe, we will need you to provide them
for confirmation before delivering your parcel.
For complaints or further support kindly contact our 24/7 support team .
With kind regards,
2017 © DHL International GmbH. All rights reserved.
DHL Worldwide Delivery ©

htytytytolop

Phishing screenshot :

Email analysis :

NOTE : pjatania@atulauto.co.in
NOTE : Received : from mail.atulauto.co.in ([27.54.160.78])


NOTE : Received : from atulauto.co.in (unknown [192.95.20.146])


NOTE : by mail.atulauto.co.in

Phishing analysis :

CLICK : click here
OPEN : http://workingin-visas.com.au/track/dhl/index.php?email=0
REDIRECT : http://workingin-visas.com.au/track/dhl/tracking.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=0
SCREENSHOT :

Emailing: MD10 - 01.11.2017 (Virus)

Your message is ready to be sent with the following file or link
attachments:
MD10 - 01.11.2017

Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your
e-mail security settings to determine how attachments are handled.

--
Thanks & Regards
Eric Sherwin
Senior Officer
Accounts & Finacne

MD10 - 01.11.2017.doc

Email analysis :

NOTE : Eric_dhiman@dickscheid.net
NOTE : Received : from 84.120.144.159.dyn.user.ono.com
NOTE : (84.120.144.159.dyn.user.ono.com [84.120.144.159])


NOTE : User-Agent : Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101 Thunderbird/27.0

File analysis :

- OPEN : MD10 - 01.11.2017.doc
- FILE MD10 - 01.11.2017.doc is a virus

Virus analysis :

{"scans": {"Bkav": {"detected": false, "version": "1.3.0.9367", "result": null, "update": "20171102"}, "TotalDefense": {"detected": false, "version": "37.1.62.1", "result": null, "update": "20171102"}, "MicroWorld-eScan": {"detected": false, "version": "14.0.297.0", "result": null, "update": "20171103"}, "nProtect": {"detected": false, "version": "2017-11-03.01", "result": null, "update": "20171103"}, "CMC": {"detected": false, "version": "1.1.0.977", "result": null, "update": "20171102"}, "CAT-QuickHeal": {"detected": false, "version": "14.00", "result": null, "update": "20171102"}, "McAfee": {"detected": false, "version": "6.0.6.653", "result": null, "update": "20171031"}, "Malwarebytes": {"detected": false, "version": "2.1.1.1115", "result": null, "update": "20171103"}, "VIPRE": {"detected": false, "version": "62170", "result": null, "update": "20171103"}, "SUPERAntiSpyware": {"detected": false, "version": "5.6.0.1032", "result": null, "update": "20171103"}, "TheHacker": {"detected": false, "version": "6.8.0.5.2121", "result": null, "update": "20171102"}, "Alibaba": {"detected": false, "version": "1.0", "result": null, "update": "20170911"}, "K7GW": {"detected": false, "version": "10.29.25124", "result": null, "update": "20171102"}, "K7AntiVirus": {"detected": false, "version": "10.29.25131", "result": null, "update": "20171102"}, "Baidu": {"detected": true, "version": "1.0.0.2", "result": "Win32.Trojan-Downloader.Agent.kn", "update": "20171103"}, "F-Prot": {"detected": true, "version": "4.7.1.166", "result": "LNK/Downldr.gen", "update": "20171103"}, "Symantec": {"detected": true, "version": "1.4.0.0", "result": "Trojan.Mdropper", "update": "20171102"}, "ESET-NOD32": {"detected": true, "version": "16347", "result": "LNK/TrojanDownloader.Agent.HW", "update": "20171103"}, "TrendMicro-HouseCall": {"detected": true, "version": "9.950.0.1006", "result": "TROJ_POWLOAD.AUSJSH", "update": "20171103"}, "Avast": {"detected": true, "version": "17.7.3660.0", "result": "Other:Malware-gen [Trj]", "update": "20171103"}, "ClamAV": {"detected": true, "version": "0.99.2.0", "result": "Img.Dropper.PhishingLure-6362648-0", "update": "20171102"}, "Kaspersky": {"detected": true, "version": "15.0.1.13", "result": "Trojan-Downloader.MSWord.Agent.bqe", "update": "20171102"}, "BitDefender": {"detected": true, "version": "7.2", "result": "Trojan.Agent.CPMC", "update": "20171103"}, "NANO-Antivirus": {"detected": false, "version": "1.0.100.19905", "result": null, "update": "20171103"}, "ViRobot": {"detected": true, "version": "2014.3.20.0", "result": "DOC.Z.Agent.132562", "update": "20171103"}, "Tencent": {"detected": false, "version": "1.0.0.1", "result": null, "update": "20171103"}, "Ad-Aware": {"detected": false, "version": "3.0.3.1010", "result": null, "update": "20171103"}, "Emsisoft": {"detected": true, "version": "4.0.1.883", "result": "Trojan.Agent.CPMC (B)", "update": "20171103"}, "Comodo": {"detected": false, "version": "27990", "result": null, "update": "20171103"}, "F-Secure": {"detected": true, "version": "11.0.19100.45", "result": "Trojan.Agent.CPMC", "update": "20171103"}, "DrWeb": {"detected": true, "version": "7.0.28.2020", "result": "PowerShell.DownLoader.455", "update": "20171103"}, "Zillya": {"detected": false, "version": "2.0.0.3420", "result": null, "update": "20171102"}, "TrendMicro": {"detected": true, "version": "9.862.0.1074", "result": "TROJ_POWLOAD.AUSJSH", "update": "20171103"}, "McAfee-GW-Edition": {"detected": false, "version": "v2015", "result": null, "update": "20171103"}, "Sophos": {"detected": true, "version": "4.98.0", "result": "Mal/DownLnk-D", "update": "20171103"}, "Cyren": {"detected": true, "version": "5.4.30.7", "result": "ZIP/Trojan.VNUH-5", "update": "20171103"}, "Jiangmin": {"detected": false, "version": "16.0.100", "result": null, "update": "20171103"}, "Webroot": {"detected": false, "version": "1.0.0.207", "result": null, "update": "20171103"}, "Avira": {"detected": true, "version": "8.3.3.6", "result": "TR/Agent.cznoe", "update": "20171103"}, "Fortinet": {"detected": true, "version": "5.4.247.0", "result": "LNK/Agent.AG!tr.dldr", "update": "20171103"}, "Antiy-AVL": {"detected": false, "version": "3.0.0.1", "result": null, "update": "20171103"}, "Kingsoft": {"detected": false, "version": "2013.8.14.323", "result": null, "update": "20171103"}, "Arcabit": {"detected": true, "version": "1.0.0.827", "result": "Trojan.Agent.CPMC", "update": "20171103"}, "AegisLab": {"detected": true, "version": "4.2", "result": "Troj.Winlnk.Agent!c", "update": "20171103"}, "ZoneAlarm": {"detected": true, "version": "1.0", "result": "Trojan-Downloader.MSWord.Agent.bqe", "update": "20171103"}, "Avast-Mobile": {"detected": false, "version": "171102-04", "result": null, "update": "20171102"}, "Microsoft": {"detected": true, "version": "1.1.14306.0", "result": "TrojanDownloader:O97M/Donoff!lnk", "update": "20171103"}, "AhnLab-V3": {"detected": true, "version": "3.10.1.19128", "result": "LNK/Autorun.Gen", "update": "20171102"}, "ALYac": {"detected": false, "version": "1.1.1.2", "result": null, "update": "20171103"}, "AVware": {"detected": false, "version": "1.5.0.42", "result": null, "update": "20171102"}, "MAX": {"detected": true, "version": "2017.6.26.1", "result": "malware (ai score=99)", "update": "20171103"}, "VBA32": {"detected": false, "version": "3.12.26.4", "result": null, "update": "20171102"}, "WhiteArmor": {"detected": false, "version": null, "result": null, "update": "20171024"}, "Zoner": {"detected": true, "version": "1.0", "result": "LNKScript", "update": "20171103"}, "Rising": {"detected": true, "version": "25.0.0.1", "result": "Trojan.Downloader!1.A420 (CLASSIC)", "update": "20171103"}, "Yandex": {"detected": false, "version": "5.5.1.3", "result": null, "update": "20171102"}, "Ikarus": {"detected": true, "version": "0.1.5.2", "result": "Trojan-Downloader.PS.Agent", "update": "20171102"}, "GData": {"detected": true, "version": "A:25.14678B:25.10801", "result": "Trojan.Agent.CPMC", "update": "20171103"}, "AVG": {"detected": true, "version": "17.7.3660.0", "result": "Other:Malware-gen [Trj]", "update": "20171103"}, "Panda": {"detected": false, "version": "4.6.4.2", "result": null, "update": "20171102"}, "Qihoo-360": {"detected": false, "version": "1.0.0.1120", "result": null, "update": "20171103"}}, "scan_id": "db1d501eb2218c68be3b21f047195ac9c4b4420e6e66172d1a03fb99e4235d7f-1509678306", "sha1": "c10cb42d1ba7732c73c9928bd16ccfd1a161f6d6", "resource": "db1d501eb2218c68be3b21f047195ac9c4b4420e6e66172d1a03fb99e4235d7f", "response_code": 1, "scan_date": "2017-11-03 03:05:06", "permalink": "https://www.virustotal.com/file/db1d501eb2218c68be3b21f047195ac9c4b4420e6e66172d1a03fb99e4235d7f/analysis/1509678306/", "verbose_msg": "Scan finished, information embedded", "total": 61, "positives": 29, "sha256": "db1d501eb2218c68be3b21f047195ac9c4b4420e6e66172d1a03fb99e4235d7f", "md5": "a54eae632f1557f5104f57c2a87fd144"}