Monday, August 31, 2015

Ref:From:William McCarthy

My Good Friend,

Sorry for this unconventional approach.This opportunity to demand for your good relationship which will be based on mutual understanding and trust? I am wait your affirmative reply, if you are interested regards this Claim of my Late Client the email me for more details.I await your prompt reply.

Yours Sincerely,

Barrister William McCarthy

Email analysis :

NOTE : williamsmaccarthy10@gmail.com
NOTE : michel@belemimportados.com.br
NOTE : Received : from User (unknown [162.246.22.227])
NOTE : (Authenticated sender: michel@belemimportados.com.br)
NOTE : by smtp.belemimportados.com.br

©2015 World Internet Programs.

Attention: Prominent internet user,

How are you today? We hope this mail meets you in a perfect condition. This is a total cash prize of United States $500,000.00 given to the first hundred (10) people compensated in this world internet programs. All participants were selected randomly from World Wide Web site through computer draw system and extracted from over 820,000 companies worldwide. We are using this opportunity to thank you for using the internet daily. Due to your effort, using internet daily, we want to compensate you and show our gratitude to you with the sum of $500,000.00 only, We have arranged your payment through our swift card centers, which is the latest instruction from International Monetary Fund Reconciliation Office {IMF}. The card center will send you an ATM Visa card which you will use to withdraw your money in any ATM machine, Banks and Union Pay Credit outlets in the world; you are hereby selected as an honor for this payment approval, which you are to acknowledge the receipt of this mail to the Logistic Department by email listed below.

Your Id : 345HE45
Claim Number : 809366E

Contact Agent. Tom Alex with below e-mail;

Compensation Office and Logistics Vaults
Contact Agent: Tom Alex
E-mail: tomalex1@outlook.com
Tell: +234-7041-9543-05

Thanks and God bless you and your family. Hope to hear from you soon.

Yours Faithfully,
Mrs.Bessel Harris
International Online Lottery Co-ordinator.
©2015 World Internet Programs.

Email analysis :

NOTE : tomalex1@outlook.com
NOTE : sellit@fhtm.us
NOTE : Received : from User ([103.248.15.66])
NOTE : by mail.cwfood.co.kr
NOTE : (IceWarp Merak Mail Server 9.4 (2009-02-16) by SoftMail)
NOTE : 14.36.32.12 ()

Colis ref:U45254834 !!

Si le message ne s'affiche pas correctement, cliquez ici :Version en ligne .

Phishing analysis :

CLICK : Version en ligne .
OPEN : http://www.furuspesialisten.com/cls/index.html
REDIRECT : https://www.ecostore.co.il/contact/message.chronopost.livraison/
NOTE : The phishing was removed by ecostore

Email analysis :

NOTE : Votre.Colis@att.net
NOTE : Received : by trade.fibracom.fr (Postfix, from userid 33)
NOTE : Received : from trade.fibracom.fr ([93.95.59.201])
NOTE : www-data@trade.fibracom.fr
NOTE : X-Php-Originating-Script : 33:random.php
NOTE : X-Realfrom : tradecom

TELEGRAPHIC TRANSFER NOTICE

Attn: The Beneficiary

TELEGRAPHIC TRANSFER NOTICE.

We are hereby officially notify you concerning your fund telegraphic Transfer through our bank, Suntrust Bank, New York, to your bank account, which has been officially approved by the management of World Bank Swiss (WBS) to credit the sum of US$18.5 Million into your bank account.

Note that I have started processing your payment and every thing concerning the immediate remittance of your funds will be carried out within the shortest possible time from the time we received your? Below needed information.

Also be informed that the Governor of Bank in Cote D Ivoire (CI) will sign on your payment advice and a copy of the advice will be sent to the World Bank in Swiss for some record purposes. Meanwhile your information and your full contact details were received from our research manager, Barr.Paul Peterson on your behalf to FRB for immediate release of your fund.

This fund was part of usa lottery unclaim discovery fund with World Bank of Switzerland, which the Swiss Bank has decided to distribute it generously to help few lucky individuals and the American Government is in agreement with the Swiss Bank to distribute the fund to 700 hundred thousand people in America, Europe & Asia in other to help improve their businesses.

Therefore, reconfirm the aforesaid information accurately, because this office cannot afford to be held liable for any wrong transfer of funds or liable of any fund credited into an unknown account.

These are the information we needed to be reconfirmed by you.

1.Your Full Bank Account Details
2.Your Direct Cell or office phone to reach you
3.Your address of locations
4.Your full name

Finally, you are required to reconfirm directly to me the above information to enable me use it to process your bill of payment. Your quick response shall be mostly appreciated; all your response should be directed through our alternative email address for the immediate attention of the credit control department.

Yours Faithfully,
Dr.Fred Willison.
Vice Chairman, Director, Credit /Telex Department

Email analysis :

NOTE : xbankofamerican@gmail.com
NOTE : xxxbankofameric688@gmail.com
NOTE : marilobouabre20@yahoo.co.jp
NOTE : Received : from [41.189.47.193]


NOTE : by web101518.mail.kks.yahoo.co.jp
NOTE : X-Mailer : YahooMailWebService/0.8.111_67

Notice to Appear

Notice to Appear,

This is to inform you to appear in the Court on the September 02 for your case hearing. You are kindly asked to prepare and bring the documents relating to the case to Court on the specified date.

Note: The case may be heard by the judge in your absence if you do not come.

The copy of Court Notice is attached to this email.

Regards,
Gary Noble,
Court Secretary.

000475484.zip

File analysis :

OPEN : 000475484.zip
RESULT : File is a virus.

Virus analysis :

SHA256 : 0c8d2b8cba6611097793124c3dac9e9313207ba8857b41330ca021c89f52c82f
ALYac : JS:Trojan.JS.Downloader.AN
AVG : JS/Downloader.Agent
AVware : Malware.JS.Generic (JS)
Ad-Aware : JS:Trojan.JS.Downloader.AN
Arcabit : JS:Trojan.JS.Downloader.AN
Avast : JS:Agent-DOB [Trj]
BitDefender : JS:Trojan.JS.Downloader.AN
CAT-QuickHeal : JS.Downloader.Z
Comodo : Heur.Dual.Extensions
DrWeb : SCRIPT.Virus
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AV
Emsisoft : JS:Trojan.JS.Downloader.AN (B)
F-Secure : JS:Trojan.JS.Downloader.AN
Fortinet : JS/Agent.CPL!tr
GData : JS:Trojan.JS.Downloader.AN
Kaspersky : Trojan-Downloader.JS.Agent.hhe
McAfee : JS/Nemucod.c
McAfee-GW-Edition : JS/Nemucod.c
Microsoft : TrojanDownloader:JS/Nemucod.P
NANO-Antivirus : Trojan.Script.Agent.dtchtk
Rising : NORMAL:Trojan.DL.Script.JS.Nemucod.b!1616509[F1]
Sophos : JS/DwnLdr-MON
VIPRE : Malware.JS.Generic (JS)
nProtect : JS:Trojan.JS.Downloader.AN

Email analysis :

NOTE : Notice to Appear
NOTE : gary.noble@wayneshostingworld.co.uk
NOTE : Received : from doggroom by server.wayneshostingworld.co.uk with local (Exim 4.85)
NOTE : Received : from server.wayneshostingworld.co.uk (wayneshostingworld.co.uk. [78.129.234.106])
NOTE : X-Php-Script : doggroomingparlour.co.uk/post.php for 77.111.207.70

Invoice Jeff Herman


invoice53444271 Jeff Herman.zip

File analysis :

OPEN : invoice53444271 Jeff Herman.zip
RESULT : File is a virus.

Virus analysis :

SHA256: 9c6ce032c5b4f521b0ace607a50a499812ecb9845741862a0f7f9183a87c7c49

ALYac : Trojan.Agent.BMBU
AVG : FakeAlert
AVware : Trojan.Win32.Generic!BT
Ad-Aware : Trojan.Agent.BMBU
Agnitum : Trojan.DL.Dofoil!MdY5QMP4IPM
Arcabit : Trojan.Agent.BMBU
Avast : Win32:Trojan-gen
Baidu-International : Trojan.Win32.Dofoil.bstr
BitDefender : Trojan.Agent.BMBU
CAT-QuickHeal : TrojanDownloader.Upatre.r4
Cyren : W32/Trojan3.RIE
ESET-NOD32 : a variant of Win32/Kryptik.DUYG
Emsisoft : Trojan.Agent.BMBU (B)
F-Prot : W32/Trojan3.RIE
F-Secure : Trojan.Agent.BMBU
Fortinet : W32/Kryptik.DUMX!tr
GData : Trojan.Agent.BMBU
Ikarus : Trojan-Downloader.Win32.Upatre
Jiangmin : TrojanDownloader.Dofoil.bhq
K7AntiVirus : Trojan ( 004cddfe1 )
K7GW : Trojan ( 004cddfe1 )
Kaspersky : Trojan-Downloader.Win32.Dofoil.bstr
Malwarebytes : Spyware.Dyre
McAfee : Upatre-FACE!67B2464F5D77
McAfee-GW-Edition : Upatre-FACE!67B2464F5D77
MicroWorld-eScan : Trojan.Agent.BMBU
Microsoft : TrojanDownloader:Win32/Upatre
NANO-Antivirus : Trojan.Win32.Dyre.dvrjgu
Panda : Trj/CI.A
Qihoo-360 : HEUR/QVM19.1.Malware.Gen
Sophos : Troj/Upatre-LD
TrendMicro : TROJ_UP.10D6D122
TrendMicro-HouseCall : TROJ_UP.10D6D122
VBA32 : Heur.Trojan.Hlux
VIPRE : Trojan.Win32.Generic!BT
ViRobot : Trojan.Win32.Upatre.43520.A[h]
Zillya : 'Downloader.UpatreGen.Win32.68
nProtect : Trojan.Agent.BMBU

Email analysis :

NOTE : bespalov@stati.orene.ru
NOTE : Received : by stati.orene.ru (Postfix, from userid 5001)
NOTE : 94.79.7.6 ()