Sunday, August 31, 2014

my new photo ;) (Virus)

my new photo ;)
if you like my photo to send me u photo

< photo.zip >

Virus Analysis :

AVG SHeur4.CBFB 20140830
AVware Trojan.Win32.Generic!BT 20140830
Ad-Aware Trojan.Agent.BEZQ 20140830
AntiVir TR/Dropper.VB.18514 20140830
Avast Win32:Trojan-gen 20140830
BitDefender Trojan.Agent.BEZQ 20140830
ByteHero Virus.Win32.Heur.p 20140830
Cyren W32/Trojan.OVUX-2230 20140830
DrWeb BackDoor.Tishop.122 20140830
ESET-NOD32 Win32/TrojanDownloader.Zurgop.BK 20140830
Emsisoft Trojan.Agent.BEZQ (B) 20140830
F-Secure Trojan.Agent.BEZQ 20140830
GData Trojan.Agent.BEZQ 20140830
Ikarus Trojan.Inject 20140830
Kaspersky Trojan.Win32.Inject.qtsd 20140830
Malwarebytes Spyware.Zbot.ED 20140830
McAfee Dropper-FLO!01BD3D688F14 20140830
McAfee-GW-Edition Dropper-FLO!01BD3D688F14 20140830
MicroWorld-eScan Trojan.Agent.BEZQ 20140830
Sophos Troj/VB-HOC 20140830
Symantec Trojan.Smoaler 20140830
VIPRE Trojan.Win32.Generic!BT 20140830

ASM DLL Analysis :

; Imports from SHELL32.DLL
imp_SHCreateShellItem:
00401000 F4 hlt ; XREF=0x4010ae
00401001 db 0x0e
00401002 db 0x91
00401003 db 0x73
00401004 0000 add byte [ds:eax], al
00401006 0000 add byte [ds:eax], al

; Imports from NETAPI32.DLL
imp_NetGetDCName:
00401008 dd 0xffffffff ; XREF=0x4010a8
0040100c 0000 add byte [ds:eax], al
0040100e 0000 add byte [ds:eax], al

; Imports from MSVBVM60.DLL
imp_ordinal_669:
00401010 dd 0x7294a1bb ; XREF=0x40109c
imp_ordinal_598:
00401014 dd 0x72a0e0f7 ; XREF=0x40108a
imp_ordinal_631:
00401018 dd 0x72a26fe2 ; XREF=0x401090
imp_ordinal_632:
0040101c dd 0x72a2702f ; XREF=0x401096
imp_EVENT_SINK_AddRef:
00401020 dd 0x72a09b74 ; XREF=0x4010c0
imp_DllFunctionCall:
00401024 dd 0x7294a0fd ; XREF=0x401060
imp_EVENT_SINK_Release:
00401028 dd 0x72a09b87 ; XREF=0x4010c6
imp_EVENT_SINK_QueryInterface:
0040102c dd 0x72a09a85 ; XREF=0x4010ba
imp___vbaExceptHandler:
00401030 dd 0x72a247df ; XREF=0x4010b4
imp_ordinal_717:
00401034 dd 0x72a28fe9 ; XREF=0x401066
imp_ProcCallEngine:
00401038 dd 0x72a3d05d ; XREF=0x4010cc
imp_ordinal_535:
0040103c dd 0x72a1c85d ; XREF=0x401084
imp_ordinal_644:
00401040 dd 0x72a1de99 ; XREF=0x401078
imp_ordinal_648:
00401044 dd 0x72a14275 ; XREF=0x401072
imp_ordinal_578:
00401048 dd 0x72a161f8 ; XREF=0x4010a2
imp_ordinal_100:
0040104c dd 0x729435a4 ; XREF=0x4010d2
imp_ordinal_616:
00401050 dd 0x72a26d9a ; XREF=0x40106c
imp_ordinal_544:
00401054 dd 0x72a11c93 ; XREF=0x40107e

Saturday, August 30, 2014

Diplomat William Cassello

Attention:Beneficiary,

I am Diplomat William Cassello , mandated to deliver your inheritance/contract sum to you in your country of residence. The funds total US$15.5 Million and you were made the beneficiary of these funds by a benefactor whose details will be revealed to you after handing over the funds to you in accordance with the Agreement I signed with the benefactor when he enlisted my assistance in delivering the funds to you. I am presently in your country and I have just left the International Airport to the storage house where will be conducive for the fund before proceeding to your resident and before I can deliver the package (funds) to you, you have to reconfirm the following information so as to ensure that I am dealing with the right person:

Your Complete Names as illustrated herein: Surname/ Middle Name/ Other Names
2. Residential Address
3. Age
4. Occupation
5. Direct cell phone Numbers
6. A Copy of Your Identification

Contact Telephone Numbers. This number has to be a working number and a number where you can be reached easily. You will be called on the number by the delivery agent before the funds is handed over to you. So, its important that you provide a working number for easy communication. If your number is on voice mail, remove it immediately so that the officer can speak to you. We therefore want to use this medium to apologize for any inconvenience the delay in releasing the funds may have caused you and your family. After verification of the information with what I have on file, I shall contact you so that we can make arrangements on the exact time I will be bringing your package to your residential address. Send the requested information so that we can proceed.

Regards

Diplomat William Cassello
DELIVERY SERVICES AGENT, U.S.A.
Tel:940-602-8690

Rép : Thank you for your past effort.

Dear Friend

I wish to inform you that I finally succeeded in transferring the US$3.8 million to Japan where i am residing presently with my only son. I decided to compensate you for your efforts in this transaction with the sum of $450,000 dollars which i made out in an ATM Card and kept it with my spiritual father for you. Kindly Contact him immediately on the contact details described below;

Rev. Father John Clegg
St. Mark Church of England
Phone: +234 909 994 4189
E-mail: rev.jclegg@yahoo.com

He Will send your ATM Card to you without delay. I thank you once more for all your time and effort.

Best regard
Dr. Larry Smith

Rép : Your urgent attention will be required.

Hello Beneficiary,

How are you today? We have been mandated to transfer your funds to your nominated Bank account in your country, please re-confirm to us you are the rightful beneficiary before we can proceed accordingly. Therefore, also affirm to us how much you're being owed by the African Bank for our final scrutiny to release your funds. Your full name, address and telephone number will be required as well for preparing the final fund's release order document.

Your urgent attention is required.

Robert

SHIPMENT

I am David Ellis Head of Inspection Unit United Nations Inspection Agency in Harts field-Jackson International Airport Atlanta, Georgia. During our investigation, I discovered An abandoned shipment through a Diplomat from United Kingdom which was transferred from JF Kennedy AirportTo our facility here in Atlanta, and when scanned it revealed an undisclosed sum of money in 2 Metal Trunk Boxes weighing approximately 110kg each.

CONTACT EMAIL.... DAVIDELLIS581@YAHOO.COM.PH

The consignment was abandoned because the Content was not properly declared by the consignee as money rather it was declared as personal Effect/classified document to either avoid diversion by the Shipping Agent or confiscation by the relevant authorities. The diplomat's inability to payfor Non Inspection fees among other things are the reason why the consignment is delayed and abandoned. By my assessment, each of the boxes contains about $4M or more.They are still left in the airport storage facility till today. The Consignments like I said are two metal trunk boxes weighing about 110kg each (Internal dimension: W61 x H156 x D73 (cm) effective Capacity: 680 L) Approximately. The details of the consignment including your name and email on the official document from United Nations' office in London where the shipment was tagged as personal effects/classified document is still available with us. As it stands now, you have to reconfirm your Full name, Phone Number, full address so I can cross-check and see if it corresponds with the one on the official documents. It is now left to you to decide if you still need the consignment or allow us repatriate it back to UK (place of origin) as we were instructed.

CONTACT EMAIL.... DAVIDELLIS581@YAHOO.COM.PH

Like I did say again, the shipper abandoned it and ran away most importantly because he gave a false declaration, he could not pay for the yellow tag, he could not secure a valid non inspection document(s), etc. I am ready to assist you in any way I can for you to get back this packages provided you will also give me something out of it (financial gratification). You can either come in person, or you engage the services of a secure shipping/delivery Company/agent that will provide the necessary security That is required to deliver the package to your doorstep or the destination of your choice. I need all the guarantee that I can get from you before I can get involved in this project.

Best Regards,
David Ellis
INSPECTION OFFICER
CONTACT EMAIL.... MR_DAVIDELLIS923@YAHOO.COM.PH

YOU HAVE TO CONTACT THE RIGHT OFFICE FOR YOUR FUNDS

INTERNATIONAL RECONCILIATION AND LOGISTICS VAULT
UNITED NATIONS OFFICE (UN)
COMPENSATION SETTLEMENT OF ESCROW ACCOUNTS.

It is a pleasure to write you that we have reconciled with our logistic department on the reimbursement of some fund spent by you during the cause of your inadequate dealings with some imposters who claim to be staff in banks and other regional payment centers. Our reconciliation teams with the prospectus instrument of the United Nations after freezing suspected imposters account. This support was fully effective with the help of World Bank after a summit meeting in London, on the financial analysis and financial stability issues fluctuating the economy with the international global standard. After gathering of this sum, our logistic department gave us a list of beneficiaries to be paid a sum of $2.850,000.00 United States Dollars who fell victims to these imposters due to unawareness. And mode of payment was as well specified for proper conducts and financial regulations to kick against criminality during process of payment. We have arranged your payment through our swift card centers, with the latest instruction from United Nations Office And International Monetary Fund Reconciliation Office. The card center will send you an Atm Master Card which you will use to withdraw your money in any Atm Center, Banks and Union Pay Credit outlets in the world; You are hereby selected as an honor for this payment approval worth $2.850,000.00 United States Dollars, which you are to acknowledge the receipt of this mail in returning the required below to the Logistic Department by email listed below for immediately release of your above stated compensated funds so that there will be not mistake while delivering your funds to your home.

Office of Reconciliation and Logistics Vaults,
United Nations Office Representatives In Nigeria
Contact Information Officer: Mr. Donald Bold
Email: mrdonaldbold@email.com
Tele:+2348182595393

1. Full Name
2. Phone Number
3. Contact Address
4. Country

For your information, you have to stop any further communication with any other person or office claiming to be the right office to avoid any hitches in receiving your payment. Because of Impostors, we hereby issued you our code of conduct, which is (Atm-7750) so you have to indicate this code when contacting the Card Center by using it as your subject. Kindly be informed that recipients shall be liable to pay $350 dollars which is obvious cost arising for the delivery of the donation parcel and there will be no hidden fees. This is due to Legal law protecting all donation funds misappropriation.

Yours in Service,

Mr. Ban Ki-Moon
UNITED NATIONS OFFICE
www.un.org/en/