Thursday, August 24, 2017

317061979269082.doc (Virus)

317061979269082.doc

Email analysis :

NOTE : Return-Path: < noreply@xo.net >
NOTE : identity=mailfrom; client-ip=208.36.229.61;
NOTE : helo=xo.net; envelope-from=noreply@xo.net;
NOTE : Received: from xo.net (208.36.229.61.ptr.us.xo.net [208.36.229.61])
NOTE : Content-Type: application/msword; name="317061979269082.doc"
NOTE : From: < noreply@ulegv.com >
NOTE : 208.36.229.61.ptr.us.xo.net)

Virus analysis :

Ad-Aware W97M.Downloader.GDB
AegisLab Troj.Script.Agent!c
AhnLab-V3 W97M/Downloader
ALYac Trojan.Downloader.W97M.Gen
Arcabit HEUR.VBA.Trojan.e
Avast Other:Malware-gen [Trj]
AVG Other:Malware-gen [Trj]
Avira W97M/Dldr.Agent.mgjui
Baidu VBA.Trojan-Downloader.Agent.bup
BitDefender W97M.Downloader.GDB
Comodo UnclassifiedMalware
Cyren PP97M/Downldr
DrWeb W97M.DownLoader.1961
Emsisoft Trojan-Downloader.Agent (A)
eScan W97M.Downloader.GDB
ESET-NOD32 VBA/TrojanDownloader.Agent.DYZ
F-Prot New or modified PP97M/Downldr
F-Secure W97M.Downloader.GDB
Fortinet WM/Agent.Q!tr.dldr
GData W97M.Downloader.GDB
Ikarus Trojan-Downloader.VBA.Agent
Kaspersky HEUR:Trojan.Script.Agent.gen
MAX malware (ai score=99)
McAfee W97M/Downloader.cfm
McAfee-GW-Edition W97M/Downloader.cfm
Microsoft TrojanDownloader:O97M/Donoff
Panda O97M/Downloader
Sophos AV Troj/DocDl-KBA
Symantec W97M.Downloader
Tencent Win32.Trojan-downloader.Agent.Sxyr
TrendMicro W2KM_DLOADR.YYTCY
TrendMicro-HouseCall W2KM_DLOADR.YYTCY
ViRobot W97M.S.Agent.76249
ZoneAlarm HEUR:Trojan.Script.Agent.gen

reply (Inheritance scam)

Based on our investigation of your payment, we want to find out if you're still alive or did you sign any deed of assignment with (Ms Grace Smith) to receive your contract /Inheritance payment worth of US$7.5M, reply to us with the following details, Your Name: ,Your Address ,Your Age/Sex,Your Mobile No: to email: imforangisation@gmail.com OR CALL +91-886 059 1944

Yours Sincerely,
Mr. Adrian Tobias
IMF Resident Representative
Tel:+91-886 059 1944

Email analysis :

NOTE : imforangisation@gmail.com
NOTE : albanizaluciano@agespisa.com.br
NOTE : Received : from mail.agespisa.com.br ([127.0.0.1])
NOTE : by localhost (mail.agespisa.com.br [127.0.0.1])
NOTE : Received : from mail.agespisa.com.br
NOTE : (mail.agespisa.com.br [172.20.1.72])
NOTE : Received : from mail.agespisa.com.br
NOTE : (mail.agespisa.com.br. [200.217.241.123])

Your PayPal account has been temporarily Locked! (PayPal Phishing)

paypal

Welcome

Dear *@*,

Your paypal account has been blocked temporarily . It usually means that we need some more information about your account or recent transactions please Activate your account so we can confirm that you own the account
To activate your account, just confirm your information.(It only takes a minute.)

Activate

Once you've activated your account, you can shop online without exposing your financial information. PayPal is accepted worldwide at millions of sites - including some of your favorites, like Dell.com, iTunes, and more.

Yours sincerely,
PayPalYours sincerely,
PayPal

Email analysis :

NOTE : service@paypal.coml
NOTE : Received : from MSSQL-HP3
NOTE : (aazo117.neoplus.adsl.tpnet.pl. [83.6.152.117])


Phishing analysis :

CLICK : the activate button
OPEN : https://www.balharbourshops.com/images/ujn///
REDIRECT : http://www.antichitachiossone.com/bn/
REDIRECT : http://www.antichitachiossone.com/bn/home/webapps/72dfb/websrc
SCREENSHOT :


TEST : FAKE ACCOUNT
REDIRECT : http://www.antichitachiossone.com/bn/home/webapps/72dfb/webscr?cmd=_login-run&dispatch=*
SCREENSHOT :


CLICK : Try again.
OPEN : http://www.antichitachiossone.com/bn/home/webapps/72dfb/webscr?cmd=_login-run&dispatch=*
SCREENSHOT :


CLICK : CONTINUE
REDIRECT : http://www.antichitachiossone.com/bn/home/myaccount/28eb3/websrc?cmd=_update-information&account_address=*&session=*
SCREENSHOT :

Wednesday, August 23, 2017

Antonin (Military Scam)

I am Sgt Antonin Andel, i have a project for you.

Email analysis :

NOTE : antonin.andel@outlook.fr
NOTE : postmaster@spamwall.quilmes.gov.ar
NOTE : designates 190.120.191.6 as permitted sender)
NOTE : client-ip=190.120.191.6;


NOTE : Received : from [192.168.0.100] (unknown [43.240.7.127])

Bonjour (Arnaque financement)

Bonjour,

Par respect, êtes-vous en besoin de financement ? Si oui, je vous expliquerai plus en détails dans mon prochain mail.

A vous lire,

Linette TROST

Email analysis :

NOTE : sperandeosnc@tin.it
NOTE : linette.trost@gmail.com
NOTE : X-Originating-Ip : 41.138.89.213:49283


NOTE : sperandeosnc@tin.it designates 212.216.176.195
NOTE : as permitted sender) client-ip=212.216.176.195;

Your response is highly appreciated!!

Hello ,

I am specifically contacting you in respect of a business proposal that I have for you as you appear very relevant in the proposal.

Please kindly reply back to me for further details.

Waiting to hear from you.

Regards,

Mr.Adams Salem

Email analysis :

NOTE : mradamssalem@mail.ru
NOTE : do.tapia@centrosur.gob.ec
NOTE : Received : from DESKTOP-THKGO5T.localdomain
NOTE : (unknown [169.159.126.174])


NOTE : by mail.iniciativa.cat (Postfix)

PRIVATE....

I am seeking your assistance in helping me receive a large amount of money and in giving a clear research and feasibility study on areas I could invest on. If you are interested then kindly send your feedback to this mailbox: mrmichealwuu14@yahoo.com.hk

Regards,
Micheal Wu

Email analysis :

NOTE : mrmichealwuu14@yahoo.com.hk
NOTE : drmartens.trinoma@cln.com.ph
NOTE : Received : from [74.208.131.168]
NOTE : (unknown [74.208.131.168])


NOTE : by mail.cln.com.ph (Postfix)

how are you doing my dear,

i have a personal reason of writing you now.write to me ok

Email analysis :

NOTE : davidmiller5113@gmail.com
NOTE : michael.un@yahoo.com
NOTE : Content-Type : text/plain; charset="UTF-8"
NOTE : 209.85.220.65 as permitted sender

Tuesday, August 22, 2017

This page was sent to you by Mr Jason Drew from CAHHALL MORTGAGE (Email Leak)

Mr Jason Drew from CAHHALL MORTGAGE I WANT YOU TO KNOW THAT WE ARE CURRENTLY GIVING OUT LOANS AT 3 INTEREST RATEAPPL NOW AND BE FINANCIALLY STABLED EMAIL CASHHALLORGGMAILCOM would like to let you know about his interesting page. Please click on the following link to view the page:

http://www.jnj.ch/en/careers/candidate-info-center.html

Johnson & Johnson AG

--------------------------

Johnson & Johnson AG
Rotzenbühlstrasse 55
CH – 8957 Spreitenbach

Tel. +41 56 417 33 33
Fax +41 56 417 35 00

Email analysis :

NOTE : CASHHALL.ORG@GMAIL.COM
NOTE : X-Php-Originating-Script : 1001:SimpleMailInvoker.php
NOTE : 148.251.83.5 (bplusd01.bplusd-interactive.de)


NOTE : Received : from cilag by jnj33.bplusd-interactive.de with local (Exim 4.82)

Email leak (504 emails) :

juve-ad@hotmail.com, cmbusi_sas@hotmail.com, mastermindbp@yahoo.com, dcarsurfgurl72@yahoo.com, kevinmj4@gmail.com, c3craske@hotmail.co.uk, jlluent@gmail.com, jerryl5511@aol.com, jjoseclararivera@gmail.com, ps3@live.com, mariza1987@gmail.com, yaonalejandro@yahoo.com, amotemarco@hotmail.com, jtennyson9@aol.com, dalmar_1995@hotmail.com, parthsoni_786@yahoo.com, chabelita85_1@yahoo.com, ferrary1970@hotmail.com, garcia.lais@gmail.com, britneybrit@msn.com, zacatac26@yahoo.com, gricelia_05@hotmail.com, imister2@hotmail.com, flor.i.94@hotmail.com, eriniboyd@gmail.com, legocow123@gmail.com, rosemarypena45@gmail.com, fakhir02@hotmail.com, rcrogers61@hotmail.com, jessicaryanwalker@gmail.com, hoangthangknh08@gmail.com, budhachic@hotmail.com, pelusina_73@hotmail.com, krystacoggin@hotmail.com, kenmasse@hotmail.com, herewearenow@hotmail.com, tylerlamlam@gmail.com, vananh_666@yahoo.com, pcermak@gmail.com, md1925@gmail.com, dennyp4work@gmail.com, pareja953@gmail.com, peggypotvin27@hotmail.com, st ring_4all@hotmail.com, weider.mcf@hotmail.com, nia_sya07@yahoo.com, orelie_meffe@hotmail.com, rohit_karanth@yahoo.com, umair.ikhlaq@yahoo.com, jordanstreeter9@gmail.com, mano_barbiedoll@hotmail.com, enos_enoc@yahoo.com, scottslaten@hotmail.com, aod2545@hotmail.com, n-hamdan2008@hotmail.com, adobe.yumos@hotmail.com, nicolo.defelice99@yahoo.com, agsfly1@gmail.com, unikcontent@gmail.com, acisternas50@hotmail.com, anairda_iaras@hotmail.com, lisiming714@gmail.com, terrencenurse@gmail.com, linam_amaya@hotmail.com, pedrito_96_07@hotmail.com, thisandthat100@gmail.com, lhighshaw@gmail.com, lakers_49ers@hotmail.com, slim-chic@live.com, miguel.852456@hotmail.com, alondriz_24@hotmail.com, hsfolck@hotmail.com, sol_veras_03@hotmail.com, thirumalaivkp@gmail.com, poloo_714@hotmail.com, mrcrusher236@gmail.com, chavanketki@yahoo.com, critii.mca@hotmail.com, marsjoan@msn.com, andresleoflorez@gmail.com, sierra.sonier@yahoo.com, nelsonmyc@hotmail.com, twochixlogistics@yahoo.com, sis_k0403@yahoo.com, edn a14426@hotmail.com, kybosports@gmail.com, cahmilla_rsfr@hotmail.com, kimberlybolden2011@gmail.com, zachthomas1207@gmail.com, kpxaznjung86@hotmail.com, smiku294@gmail.com, om3r4nn@hotmail.com, loveaddict_vs@hotmail.com, minaei.1981@gmail.com, shijukakkara@gmail.com, bigbrotheril@hotmail.com, rakesh.flair@gmail.com, n-eil_17@hotmail.com, margaretwhiting@hotmail.com, charudatta09@gmail.com, rahimbo@hotmail.com, rocio.munoz1996@gmail.com, nplessjensen2@googlemail.com, louisdung9x@gmail.com, zorachan99@gmail.com, princess_hermioninne@hotmail.com, sarahireland97@hotmail.com, gian_al_92@hotmail.com, beavolin1048@hotmail.co.uk, qyeb_boy@yahoo.com, smihtuncay06@hotmail.com, luciana_mp@hotmail.com, sundarbiswas@yahoo.co.in, jd_2274@yahoo.com, tom.shockman@gmail.com, marciobezerramarketeiro@hotmail.com, fabian260398@hotmail.com, mexicali_rap@hotmail.com, upsman132@yahoo.com, pao.r.r@hotmail.com, blankpeter58@yahoo.com, sucrylhas@hotmail.com, adri00@hotmail.com, workmncomp@aol.com, roland.mijar es@yahoo.com, guilhermegrandchase@hotmail.com, patel.vatsal16@yahoo.com, ebeville63@yahoo.com, baagiicccp@yahoo.com, huangzemin96@gmail.com, el_poeta_isaac@hotmail.com, johan-082010@hotmail.com, faikar.azim@yahoo.com, antopom@hotmail.com, emanbutt92@yahoo.com, aimstr8@gmail.com, ege_35-2@hotmail.com, andi.jagsch@gmail.com, amymear@gmail.com, mm66282@gmail.com, esirtgen@gmail.com, pysycutzapysy19@yahoo.com, fx_ym@yahoo.com, aryanblitar@yahoo.com, therciopbtjg@hotmail.com, ashleycat83@yahoo.com, calatayudweb1@gmail.com, thexikito-grone@hotmail.com, gideon.iii@gmail.com, loka-ariele@hotmail.com, danielle.gilopes@hotmail.com, disahign.estudio@gmail.com, craftdinner007@hotmail.com, bamf5285@gmail.com, demente.angl@hotmail.com, gaikwad71suraj@gmail.com, fifthmouse@gmail.com, gente.educada@gmail.com, angelicajoycortez@gmail.com, anhviet1505@gmail.com, danielhglendinning@gmail.com, choll.pu@gmail.com, timber_rat@yahoo.com, up2you26@live.com, abdulbasit.khidir@gmail.com, adamfarago@hotmail.c om, polciar@gmail.com, le.thanhhuyen1987@gmail.com, chrstphrwrght3@gmail.com, mlevex@gmail.com, dipti.gorecha@gmail.com, erictaro8@hotmail.com, kinder_teo@yahoo.com, ng1390@gmail.com, roman9686@gmail.com, thescotts108@gmail.com, muki_k1@hotmail.com, l.natasha.hay@gmail.com, arreokim@yahoo.com, sense_lu@hotmail.com, sweety.bangera@gmail.com, yulicarbb@hotmail.com, gildanasengoku@hotmail.com, mikafalck@yahoo.com, mennaabouzeid@gmail.com, ash3229@hotmail.com, revoloutionzz@gmail.com, cantrelljohn32@yahoo.com, kaylyn_armybrat@yahoo.com, amorimpt@gmail.com, cr7327@hotmail.com, tai_suke@hotmail.com, theguv86@gmail.com, peace_luvzed08@yahoo.com, ostpizzan@gmail.com, heeradevishairulla@gmail.com, tominespatrick@yahoo.com, mateen_sher@hotmail.com, tavo-3111@hotmail.com, deboradesigns@hotmail.com, guilherme609@yahoo.com, heathhgrayson@gmail.com, oshiris727@hotmail.com, gcpaprion@hotmail.com, egedirenc@gmail.com, francisco_valdi_718@hotmail.com, cara.sings@hotmail.com, freemugs@gmail.com, brad y_lyman77@hotmail.com, alys_start_6@hotmail.com, connor_sutherland@hotmail.com, lisa_orsini@hotmail.com, ole1047@msn.com, sailingsylke@hotmail.com, anthony_c_hill@hotmail.com, akrossen@msn.com, lyncht118@gmail.com, adellisarazu@yahoo.com, sqc1834@hotmail.com, akabueze99@yahoo.com, danydvc_231189@hotmail.com, smarte56@hotmail.com, pequetello@hotmail.com, emir_han1235@hotmail.com, llddrr@hotmail.co.uk, norkow@gmail.com, imperial_majesty2002@yahoo.com, ashley.j.keen@gmail.com, fhdesign@mindspring.com, thomas.trucks@us.army.mil, pgmhs@optonline.net, admin@globalinternetcorp.com, tejana@email.com, keith@newformula.org, andreas@freq.com, paris75@prisedevue.com, sam.gallina@ngc.com, vlad@e2creativegroup.com, howard.womboldt@pega.com, gpike@houston.rr.com, tlinn@npark.com, johngrantham@sbcglobal.net, stanfl@earthlink.net, akira@vcube.com, saudjawed@yhaoo.co.in, jdrouin@telus.net, davidwigington@sbcglobal.net, theberge.francis@uqam.ca, juan@calvillophoto.com, harold.lloyd@lloydcontrols.com, emil@beumers.org, colins@symmen.com.au, bigfella@dsl.pipex.com, info@digipictools.com, ruault@csnsm.in2p3.fr, jari.hannukainen@elisa.net, tgarrita@iupui.edu, sdfalk@telus.net, kp4bjd@direcway.com, sancho_panza@acampos.net, macromedia@squarewithin.com, nanou1@neuf.fr, info@bjbox.com, pb9000@comcast.net, billsmith@mmcd.biz, michael@strickslpgas.com, prairiefire@earthlink.net, ewestjohn@aug.edu, nicole@kierainedesign.com, bredvig@email.dk, dnadvornick@cox.net, johnmo@austin.utexas.edu, tony@imaker.ca, aaron.packard@usd.edu, rob@wehmeierphoto.com, diane@eoir.com, rpearsal@paulbunyan.net, nullmail@ooda.airpost.net, curry17@comcast.net, pubnb@videotron.ca, mikerodriguez@comcast.net, rogerwilson74@btopenworld.com, zibbi@zibbi.com, hvejle@post.tele.dk, utbeliever@soon.com, algane@algane.fr, jevanr@rediffmail.com, tim@swellpictures.com, john.warner@rrd.com, mindstream@btinternet.com, lgcmjw@ameritech.net, charleymeyer@earthlink.net, karolina.julia@poczta.onet.pl, john@seoft.com, syed@yorkc.c om, nokoston@nokoston.com, alexva@telusplanet.net, stills@matlock.com, rysiek@um.bielsko.pl, mail@rickrussie.com, cjones@chrisjonesstudios.com, babrams@v-tek.com, naf6@ix.netcom.com, deepforest@mindspring.com, occe3@spray.se, adobe@yorn.niroj.com, domifer@optonline.net, dicktracy@gmx.li, osalord@club-internet.fr, joeoutlaw@outlawproductions.com, speckschwarte@operamail.com, pcox@mlgw.org, tim.richard@crawfordmh.org, maronoff@littlepeople.net, lefeuvrest@wanadoo.fr, keving@dockwalker.com, bci2oo5@mailinator.com, tomekrossa@cox.net, adobe@versionke.com, danmc@jps.net, maria@frozenreflections.com, junk@de-online.co.uk, kronholm@mail.dk, fotografie@wilfriedoverwater.nl, johanna.markkanen@vti.fi, look@tyleryoungcreated.com, frenchspud@earthlink.net, hally166@mail.com, napoleon.1er@laposte.net, emig@infograu.com, arthur@costerus.eu, dannyf@summer.com, spieler@matrixstructural.com, mark.whitwham@btopenworld.com, macromedia@hpgx.net, mgravel@cox.net, carole.galassi@ucop.edu, scott@smith-nel son.com, schrody@fastmail.fm, wemarsh@comcast.net, jbrown@laphamsquarterly.org, rv.giovanelli@wanadoo.fr, r.houtum@home.nl, john@liz.lu, arjgolf@mindspring.com, tgarbutt@xplornet.com, roland.hoskins@virgin.net, kevin@kevinwickphotography.com, adam@adamangel.com, bbeazely@comcast.net, jean-louis.salvignol@wanadoo.fr, clifford.johansen@telia.com, gareth@woolridge.org.uk, mfgordon4@comcast.net, emusic@pobox.com, charcot@comcast.net, msaylor@adiginfo.com, sabloom@ufl.edu, rtweten@twetensphotography.com, lowell@sbcc.edu, glen@glenalmond.us, guru@mail.maclaunch.com, mail@andybarton.com, macromedia@lostinfo.com, admin@moissat.net, jhjunk@earthlink.net, adobe@vejce.com, don1@by-print.com, ray@fajita.net, whalli1@comcast.net, info@tonymayimages.com, folbert.boersma@12move.nl, wpaley@ix.netcom.com, bob@pixel-gym.com, shawnlierow@davidbowie.com, nhelm@nmu.edu, ncavalli@ryerson.ca, hurtig@vardgarden.se, david.sharp@autoexoposure.co.uk, adobe@nplawes.com, jaime@studiomio.com, diane.trentini@opti mation.us, younisse@greatbooks.org, daho@socal.rr.com, klicrobert@insightbb.com, bour.cy@caramail.fr, catephoto@cox.net, duane@aspenpress.com, nicke.jonsson@home.se, sgorham@hccfl.edu, benj@jabbawok.net, magohe18@ono.com, niels.christophersen@get2net.dk, rampel@bezeqint.net, justinp@thefamilychurch.net, usmetz@optonline.net, terje.storksen@h-avis.no, biosim@netbox.com, blivsupport@macktez.com, conrad@planept.com, xx_baybee_ash_xx@rangers.co.uk, david@davidgunter.com, eeeeeee@eeee.com, jojo_wong8738@yahoo.com.hk, 3424@hotmail.se, reguieg.fouad@caramail.com, info@phpbackend.com, naren320271@rediffmail.com, macromedia.com@freexxx.dyndns.org, 033255235@yahoo.com.tw, dcooper288@comcast.net, matthackney@kewsoft.com, gary-yamaha@hotmaill.co.uk, adobe@web.knobby.ws, efbertram@mail.com, janssens.vranckx@telenet.be, david.laborde@adidasus.com, oskar.lindell@home.se, jackshit@rogers.com, photo@lacerdas.com, dmalatesta@praxisoft.com, sky33940@skynet.be, amenblue@earthlink.net, ionut.vlad@rdslin k.ro, ervf@sbcglobal.net, mail@graphicsarena.com, josh.willis@hp.com, fnpjf@uaf.edu, mario@mariotoscani.com, boochon@skynet.be, colek@seznam.cz, wayratze@optonline.net, vipinvenu@poornam.com, cgood34@sbcglobal.net, tdhoss@yaoo.com, david@schooleyweb.com, me53@privacy.net, tomquinlan@charter.net, markgqs@erols.com, info@ceatrus.nl, efischer@phillyburbs.com, pete@endoran.com, darkpath@optonline.net, opr@opr1700.com, chris@primesolid.com, arush@bryant.edu, kaminski.172@osu.edu, bernards@tnt21.com, krismoore@comcast.net, muncher@eatbeef.com, ray_hewitt@btinternet.com, ljhpain1@tiscali.co.uk, alepacheco@itelcel.com, simon.kavanagh@btinternet.com, bloostater@comcast.net, woutyo@quicknet.nl, silvanal@optusnet.com.au, chris@portjeff.net, ews@evanwinslowsmith.com, dbtale@netscape.net, josuealcantara@prodigy.net.mx, post@thoirs.com, clee@ibahn.com, jtwms@triad.rr.com, stephen.green@computerland.co.nz, jason@bluemtnphoto.com, slehmann@sldnet.com, fmorales@htexas.com, sime n@fangel.no, wenk@stillsman.com, wally55@j-wave.net, ebelenski@optonline.net, wouter@d-block.nl, peterleyenaar@netscape.ca, info@upaphoto.com, hackie@prohost.org, bh@epilog.com, jonathan@kerstingarchitecture.com, pascal@fuelindustries.com, didier.eyer@wanadoo.fr, jdyrek@desertlightmedia.com, ehbds@gd.nl, benb@abcwarehouse.com, audiovideo.antibes@neuf.fr, ryan.s.russell@comcast.net, florent.parent@beon.ca, spencer@shepler.org, ville.salmi@helsinkilainen.com, fssfs@fdsf.sfds, j_azaceta@telefonica.net, jamthorpe@bellsouth.net, gryff2@wanadoo.fr, toto@zeriotzeri.com, iamb@razzolink.com, juitwijk@tiscali.nl, chagen@thepolicygroup.com, management@itonet-world.nl, pmanuel@bordernet.com.au, jo.pauwels@pandora.be