Monday, August 31, 2015

Spam: Unusual Aсtіνitу : ***

Dear *** ,

Recently, there's been activity in your BankOfAmerica account that seems unusual compared to your normal account activities.

Please log in to your BankOfAmerica account to confirm your identity and update your information.

What's going on?

We're concerned that someone is using your BankOfAmerica account without your knowledge. Recent activity from your account seems to have occurred from a suspicious location or under circumstances that may be different than usual.

What to do:

Log in to your BankOfAmerica account as soon as possible.

We may ask you to confirm information you provided when you created your account to make sure you're the account holder.

Phishing analysis :

CLICK : Log in
OPEN : http://www.securityalertbofamofausa.com/page/boa/
SCREENSHOT :


Email analysis :

NOTE : admin@kyokuyo-ind.co.th
NOTE : Received : from mail.kyokuyo-ind.co.th ([202.57.154.98])
NOTE : Received : from BEABC ([122.128.109.50]) by mail.kyokuyo-ind.co.th

Que la paix de dieu soit avec vous !

Bonjour Monsieur/Madame

Je n'ai pas un autre moyen de communiquer avec vous que de vous faire parvenir ce mail. Je suis dans le désespoir et mon cœur saigne au moment ou je vous fais ce message qui j'espère retiendra votre attention. Je vous contacte aujourd'hui car bien vrai que l'on ne se connaisse pas cela n'empêche ce geste de ma part. Je me nomme Monsieur DYMOCK KEITH né le 22 JUIN 1947 à Brisbane en Australie, mais pour une raison particulière, j'ai du être un aventurier à la recherche de je ne sais quoi. La raison qui me pousse à vous, est la suivante: Je voudrais passer par votre canal pour faire une œuvre de charité dans votre département.
C'est une donation en quelque sorte et elle s'élève à la somme de 650.000 Euro. Ma situation matrimoniale est telle que je n'ai ni femme et encore moins d'enfants à qui je pourrais léguer cet héritage, et je souffre présentement d'une tumeur à la gorge je suis donc condamné à une mort certaine. C’est pour cela que, je voudrais de manière gracieuse et dans le souci d'aider les enfants démunis vous donner ce dit héritage pour réaliser cette œuvre de charité.

Si vous êtes d'accord, je voudrais avoir les informations suivantes:

•Votre nom complet
•Vos contacts
•Votre pays
•Votre ville

Je vous prie d'accorder une oreille attentive à ma proposition car je compte sur votre bonne volonté et aussi le bon usage de ces fonds pour cette œuvre.

N.B: La prochaine fois, écris moi dans ma boite personnelle: dymockkeith@gmail.com

Fraternellement

Mr DYMOCK KEITH

Email analysis :

NOTE : X-Origin : 41.216.50.54
NOTE : dymockkeith@gmail.com
NOTE : estacionpetrofesrl@speedy.com.ar
NOTE : Received : from localhost (28v.terra.com [208.84.242.166])
NOTE : (authenticated user estacionpetrofesrl!speedylm)
NOTE : by mail-smtp07-mia.tpn.terra.com
NOTE : (Postfix)

Lucas Ashford

PLEASE SEND YOUR REPLY TO { lucasashford001@hotmail.com }

Hi,

My name is Lucas Ashford, I am working With a Veterinary Company based here in Liverpool, UK. I got your contact during my comprehensive search for a reliable and trustworthy individual/company in your country. I decided to contact you for a business with our company. The company I work with is into manufacturingof Veterinary Medicines, animal food dietary and supplement.

The company procures most of their raw materials from India in past 3 years; there is a chemical which the company used to send me to India to buy. Right now I have being promoted to the post of marketing manager. The company cannot send me to India again; they will send a more junior staff,our Director has asked me for the contact details of the supplier in India. I need a person I will present to the company as the supplier in India, our company will pay some amount inadvance to supply the materials upon the verification of the sample of the chemical.

The profit would be share between you and I on 50-50 basis after the supply. I am looking for a reliable Indian business man that understands the India local language who will assist me in contacting the local dealer of these chemical in India.I don't want to contact them directly because they will take advantage on me; this business is 100% risk free and will be another income generating business outside your specialization. If you are interested to do the business with me, kindly contact me for more details with this ID: (lucasashford001@hotmail.com)

Regards,

Lucas Ashford

Email analysis :

NOTE : Ashford@weboffi433.onmicrosoft.com
NOTE : lucasashford001@hotmail.com
NOTE : Received : from SIXPR01MB048.apcprd01.prod.exchangelabs.com ([169.254.16.200])
NOTE : client-ip=104.47.126.245;

Greatings

GGCDP has programmed sixteen million five hundred thousand US dollars to legally pay to you I will explain more if you are interested. Reply direct to the stated email address: mrjustinomakweh@hotmail.com

Email analysis :

NOTE : mrjustinomakweh@outlook.com
NOTE : Received : from mail.anati.gob.pa (mail.anati.gob.pa [10.16.151.9])
NOTE : by mail.anati.gob.pa (Postfix)
NOTE : X-Originating-Ip : [197.220.169.14]
NOTE : X-Received : by 10.140.235.129 with SMTP

Private & Personal.

Private & Confidential Memo.

Top of the day to you as i write to introduce a lucrative & private business proposal to you even though we have not met or had any dealings before. I am Mr. Ryan Lambert, a staff of HM Revenue & Customs of the United Kingdom. During my recent inspections of some of our warehouses within The West Midlands Regions of The United Kingdom, i discovered a Metal Box Consignment that has been deposited since 4 (four) years ago by a SUDANESE BUSINESSMAN. I did carry out a check to find out while the said consignment has remained unclaimed for this long and i discovered that there was no valid corresponding address were we could reach him or a Next of Kin that can claim this Consignment. After much investigation and secret checking of the said Consignment, i discovered it content to be valid cash funds (bank notes)

Due to HM Revenue & Customs Ethics of duties governing all employees, i want to front you now as the Next of Kin to the Depositor of this Consignment through a duly sign and legalized Affidavit of Claim and Letter of Administration Documents that i will secure from a Notary Public here in The United Kingdom so that we can claim the said consignment and share the funds together. I am assuring you here that I will provide every useful information’s and documentations that will enable you claim this Consignment without any problem on our both sides and i also promise to provide you with further and better explanation and the full amount on the consignment box upon my receipt of a positive response from you. All that will be needed from you is just your Full Names, Residential Address (valid address), a valid copy of Identity (either International passport, national identity card or driver's license) that will be use in applying for the letter of Administration and affidavit of C
laim Documents/claiming processes

I await a prompt and positive response from you.

Best Regards,
Mr. Ryan Lambert.
Email: ryalambert@gmail.com

Email analysis :

NOTE : ryalambert@yahoo.com
NOTE : ryalambert@gmail.com
NOTE : Received : from pro1557.server4you.net (188.138.92.94)
NOTE : Received : from User (unknown [77.234.40.183]) by pro1557.server4you.net

Message from Demag OEM partner

Hi dear,

Tianjin Anson Crane Co., Ltd is a subsidiary of a General International Group, which has over 20 years’ export experience, one of the largest machines manufacturers in central China.

Anson offers an array of varying services and gantry crane, jib crane, monorail crane, balance crane, single girder crane and double girder crane. Maintenance servicing, planned repairs, inspections, upgrades, spare parts sales and installation are also part of after-sale services.

Advantage:

1. High standards, low price. (Our factory long-term international brands, demag & kone OEM to provide foundry services) we can provide the most cost-effective products.

2. From design to installation guide full service.

3. Workstation crane (key products) modular design can be applied to a variety of complex workshop situation (corners, obstacles, etc.), and can support automatic control to achieve automatic transmission production line. (Mainly for assembly shop, paint lines.)

If you are interested in our products, please reply to ask for more information.

Thank you
Alvin

Tel: +86 18503722332

Email analysis :

NOTE : huixinsoft66@foxmail.com
NOTE : service11@mx2.tradeesz.xyz
NOTE : info@balaskashotel.com

Ref:From:William McCarthy

My Good Friend,

Sorry for this unconventional approach.This opportunity to demand for your good relationship which will be based on mutual understanding and trust? I am wait your affirmative reply, if you are interested regards this Claim of my Late Client the email me for more details.I await your prompt reply.

Yours Sincerely,

Barrister William McCarthy

Email analysis :

NOTE : williamsmaccarthy10@gmail.com
NOTE : michel@belemimportados.com.br
NOTE : Received : from User (unknown [162.246.22.227])
NOTE : (Authenticated sender: michel@belemimportados.com.br)
NOTE : by smtp.belemimportados.com.br

©2015 World Internet Programs.

Attention: Prominent internet user,

How are you today? We hope this mail meets you in a perfect condition. This is a total cash prize of United States $500,000.00 given to the first hundred (10) people compensated in this world internet programs. All participants were selected randomly from World Wide Web site through computer draw system and extracted from over 820,000 companies worldwide. We are using this opportunity to thank you for using the internet daily. Due to your effort, using internet daily, we want to compensate you and show our gratitude to you with the sum of $500,000.00 only, We have arranged your payment through our swift card centers, which is the latest instruction from International Monetary Fund Reconciliation Office {IMF}. The card center will send you an ATM Visa card which you will use to withdraw your money in any ATM machine, Banks and Union Pay Credit outlets in the world; you are hereby selected as an honor for this payment approval, which you are to acknowledge the receipt of this mail to the Logistic Department by email listed below.

Your Id : 345HE45
Claim Number : 809366E

Contact Agent. Tom Alex with below e-mail;

Compensation Office and Logistics Vaults
Contact Agent: Tom Alex
E-mail: tomalex1@outlook.com
Tell: +234-7041-9543-05

Thanks and God bless you and your family. Hope to hear from you soon.

Yours Faithfully,
Mrs.Bessel Harris
International Online Lottery Co-ordinator.
©2015 World Internet Programs.

Email analysis :

NOTE : tomalex1@outlook.com
NOTE : sellit@fhtm.us
NOTE : Received : from User ([103.248.15.66])
NOTE : by mail.cwfood.co.kr
NOTE : (IceWarp Merak Mail Server 9.4 (2009-02-16) by SoftMail)
NOTE : 14.36.32.12 ()

Colis ref:U45254834 !!

Si le message ne s'affiche pas correctement, cliquez ici :Version en ligne .

Phishing analysis :

CLICK : Version en ligne .
OPEN : http://www.furuspesialisten.com/cls/index.html
REDIRECT : https://www.ecostore.co.il/contact/message.chronopost.livraison/
NOTE : The phishing was removed by ecostore

Email analysis :

NOTE : Votre.Colis@att.net
NOTE : Received : by trade.fibracom.fr (Postfix, from userid 33)
NOTE : Received : from trade.fibracom.fr ([93.95.59.201])
NOTE : www-data@trade.fibracom.fr
NOTE : X-Php-Originating-Script : 33:random.php
NOTE : X-Realfrom : tradecom

TELEGRAPHIC TRANSFER NOTICE

Attn: The Beneficiary

TELEGRAPHIC TRANSFER NOTICE.

We are hereby officially notify you concerning your fund telegraphic Transfer through our bank, Suntrust Bank, New York, to your bank account, which has been officially approved by the management of World Bank Swiss (WBS) to credit the sum of US$18.5 Million into your bank account.

Note that I have started processing your payment and every thing concerning the immediate remittance of your funds will be carried out within the shortest possible time from the time we received your? Below needed information.

Also be informed that the Governor of Bank in Cote D Ivoire (CI) will sign on your payment advice and a copy of the advice will be sent to the World Bank in Swiss for some record purposes. Meanwhile your information and your full contact details were received from our research manager, Barr.Paul Peterson on your behalf to FRB for immediate release of your fund.

This fund was part of usa lottery unclaim discovery fund with World Bank of Switzerland, which the Swiss Bank has decided to distribute it generously to help few lucky individuals and the American Government is in agreement with the Swiss Bank to distribute the fund to 700 hundred thousand people in America, Europe & Asia in other to help improve their businesses.

Therefore, reconfirm the aforesaid information accurately, because this office cannot afford to be held liable for any wrong transfer of funds or liable of any fund credited into an unknown account.

These are the information we needed to be reconfirmed by you.

1.Your Full Bank Account Details
2.Your Direct Cell or office phone to reach you
3.Your address of locations
4.Your full name

Finally, you are required to reconfirm directly to me the above information to enable me use it to process your bill of payment. Your quick response shall be mostly appreciated; all your response should be directed through our alternative email address for the immediate attention of the credit control department.

Yours Faithfully,
Dr.Fred Willison.
Vice Chairman, Director, Credit /Telex Department

Email analysis :

NOTE : xbankofamerican@gmail.com
NOTE : xxxbankofameric688@gmail.com
NOTE : marilobouabre20@yahoo.co.jp
NOTE : Received : from [41.189.47.193]


NOTE : by web101518.mail.kks.yahoo.co.jp
NOTE : X-Mailer : YahooMailWebService/0.8.111_67

Notice to Appear

Notice to Appear,

This is to inform you to appear in the Court on the September 02 for your case hearing. You are kindly asked to prepare and bring the documents relating to the case to Court on the specified date.

Note: The case may be heard by the judge in your absence if you do not come.

The copy of Court Notice is attached to this email.

Regards,
Gary Noble,
Court Secretary.

000475484.zip

File analysis :

OPEN : 000475484.zip
RESULT : File is a virus.

Virus analysis :

SHA256 : 0c8d2b8cba6611097793124c3dac9e9313207ba8857b41330ca021c89f52c82f
ALYac : JS:Trojan.JS.Downloader.AN
AVG : JS/Downloader.Agent
AVware : Malware.JS.Generic (JS)
Ad-Aware : JS:Trojan.JS.Downloader.AN
Arcabit : JS:Trojan.JS.Downloader.AN
Avast : JS:Agent-DOB [Trj]
BitDefender : JS:Trojan.JS.Downloader.AN
CAT-QuickHeal : JS.Downloader.Z
Comodo : Heur.Dual.Extensions
DrWeb : SCRIPT.Virus
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AV
Emsisoft : JS:Trojan.JS.Downloader.AN (B)
F-Secure : JS:Trojan.JS.Downloader.AN
Fortinet : JS/Agent.CPL!tr
GData : JS:Trojan.JS.Downloader.AN
Kaspersky : Trojan-Downloader.JS.Agent.hhe
McAfee : JS/Nemucod.c
McAfee-GW-Edition : JS/Nemucod.c
Microsoft : TrojanDownloader:JS/Nemucod.P
NANO-Antivirus : Trojan.Script.Agent.dtchtk
Rising : NORMAL:Trojan.DL.Script.JS.Nemucod.b!1616509[F1]
Sophos : JS/DwnLdr-MON
VIPRE : Malware.JS.Generic (JS)
nProtect : JS:Trojan.JS.Downloader.AN

Email analysis :

NOTE : Notice to Appear
NOTE : gary.noble@wayneshostingworld.co.uk
NOTE : Received : from doggroom by server.wayneshostingworld.co.uk with local (Exim 4.85)
NOTE : Received : from server.wayneshostingworld.co.uk (wayneshostingworld.co.uk. [78.129.234.106])
NOTE : X-Php-Script : doggroomingparlour.co.uk/post.php for 77.111.207.70

Invoice Jeff Herman


invoice53444271 Jeff Herman.zip

File analysis :

OPEN : invoice53444271 Jeff Herman.zip
RESULT : File is a virus.

Virus analysis :

SHA256: 9c6ce032c5b4f521b0ace607a50a499812ecb9845741862a0f7f9183a87c7c49

ALYac : Trojan.Agent.BMBU
AVG : FakeAlert
AVware : Trojan.Win32.Generic!BT
Ad-Aware : Trojan.Agent.BMBU
Agnitum : Trojan.DL.Dofoil!MdY5QMP4IPM
Arcabit : Trojan.Agent.BMBU
Avast : Win32:Trojan-gen
Baidu-International : Trojan.Win32.Dofoil.bstr
BitDefender : Trojan.Agent.BMBU
CAT-QuickHeal : TrojanDownloader.Upatre.r4
Cyren : W32/Trojan3.RIE
ESET-NOD32 : a variant of Win32/Kryptik.DUYG
Emsisoft : Trojan.Agent.BMBU (B)
F-Prot : W32/Trojan3.RIE
F-Secure : Trojan.Agent.BMBU
Fortinet : W32/Kryptik.DUMX!tr
GData : Trojan.Agent.BMBU
Ikarus : Trojan-Downloader.Win32.Upatre
Jiangmin : TrojanDownloader.Dofoil.bhq
K7AntiVirus : Trojan ( 004cddfe1 )
K7GW : Trojan ( 004cddfe1 )
Kaspersky : Trojan-Downloader.Win32.Dofoil.bstr
Malwarebytes : Spyware.Dyre
McAfee : Upatre-FACE!67B2464F5D77
McAfee-GW-Edition : Upatre-FACE!67B2464F5D77
MicroWorld-eScan : Trojan.Agent.BMBU
Microsoft : TrojanDownloader:Win32/Upatre
NANO-Antivirus : Trojan.Win32.Dyre.dvrjgu
Panda : Trj/CI.A
Qihoo-360 : HEUR/QVM19.1.Malware.Gen
Sophos : Troj/Upatre-LD
TrendMicro : TROJ_UP.10D6D122
TrendMicro-HouseCall : TROJ_UP.10D6D122
VBA32 : Heur.Trojan.Hlux
VIPRE : Trojan.Win32.Generic!BT
ViRobot : Trojan.Win32.Upatre.43520.A[h]
Zillya : 'Downloader.UpatreGen.Win32.68
nProtect : Trojan.Agent.BMBU

Email analysis :

NOTE : bespalov@stati.orene.ru
NOTE : Received : by stati.orene.ru (Postfix, from userid 5001)
NOTE : 94.79.7.6 ()