Tuesday, November 22, 2016

Maerskline Shipping BL (Phishing + Virus)

FYI

Please see attached shipping documents.

1 attachment(s)
Download | View

Best Regards

MAERSK LINE
One Commercial Place, 20th Floor
Norfolk, VA 23510
Phone: 757-857-4800
Fax: 757-852-3232
© Maersk Group.

Virus :

CLICK : DOWNLOAD
OPEN : http://original-documents.alkhalifa.pw/document/FAX_001.zip
RESULT : UNRESPONSIVE

Phishing analysis :

CLICK : View
OPEN : http://eretailday.org/img/shippingdoc/index.html
SCREENSHOT :


VALIDATE : FORM
REDIRECT : https://my.maerskline.com/?_nfpb=true&_pageLabel=page_tracking3_trackSimple

Email analysis :

NOTE : logistics@maerskline.com
NOTE : Received : from unknown (HELO ?192.168.2.254?)
NOTE : (198.72.31.234)

XMAS LOAN OFFER

2% LOAN OFFER APPLY NOW *

You lose sleep at night care how to get a loan?
* Are you looking for a loan to pay the debt?
* Are you looking for a loan to start your own business?
* Are you looking for loans to large projects perform?

CONTACT US TODAY...FAST LOAN INVESTMENT.......forward your reply here :
firstonlineloaninvesment@gmail.com

Fill out the for m to your loan application:

Name:
Country:
Amount Of Loan Needed:
Occupation:
Monthly Income:
Phone:
Length oF The Loan (years):

Note: All mail must be sent to: firstonlineloaninvesment@gmail.com

I hope to live your financial expectations.

Thank You.
2016 FIRST LOAN Co-operation

Email analysis :

NOTE : firstonlineloaninvesment@gmail.com
NOTE : plan_follow@scmt.gov.iq
NOTE : Received : from [41.113.85.128] (port=48514 helo=[172.20.10.5])


NOTE : by alsco.cloudscis.com with esmtpa (Exim 4.87)
NOTE : (envelope-from < plan_follow@scmt.gov.iq >)
NOTE : alsco.cloudscis.com : authenticated_id: plan_follow@scmt.gov.iq

Your LogMein.com subscription has expired! (Virus)

Dear client,

You are receiving this message because your subscription for LogMeIn Central has expired.
We were not able to charge you with the due amount because your credit card was declined.

You can download the bill directly from the LogMeIn website:
https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc

Please use another credit card or payment method in order to avoid complete service interruption.

Event type: Credit Card Declined
Account email: *.*
At: 21/11/2016

If you need more help, visit LogMeIn Support at:
http://solutions.logmein. com/SalesContactUs

Important Security Notice:
LogMeIn will never for your password or other sensitive information by email.

(Please don't reply to this email, as it's sent from an address that's not monitored.)

© LogMeIn Inc

Virus analysis :

CLICK : https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc
OPEN : https://reg.vn/en/view_bill.php?id=d2VibWFzdGVyQHJiY2FmZS5jb20=
DOWNLOAD : lgm_bill89831.doc
lgm_bill89831.doc : VIRUS


lgm_bill89831.doc analysis :

SHA256 : fc1f1845e47d4494a02407c524eb0e94b6484045adb783e90406367ae20a83ac
FILE : lgm_bill89831.doc
ALYac : Trojan.Downloader.W97M.Gen
Ad-Aware : W97M.Downloader.ESE
AegisLab : Troj.Downloader.Msword.Agent!c
Arcabit : W97M.Downloader.ESE
BitDefender : W97M.Downloader.ESE
Cyren : W97M/Nastjencro
ESET-NOD32 : VBA/Kryptik.T
Emsisoft : W97M.Downloader.ESE (B)
F-Prot : New or modified W97M/Nastjencro
F-Secure : Trojan:W97M/Nastjencro.A
GData : W97M.Downloader.ESE
Ikarus : Trojan-Downloader.VBA.Agent 20161121
Kaspersky : Trojan-Downloader.MSWord.Agent.auz
McAfee : W97M/Dropper.cu
McAfee-GW-Edition : W97M/Dropper.cu
eScan : W97M.Downloader.ESE
Microsoft : TrojanDownloader:O97M/Donoff!map
Sophos : Troj/DocDl-FQK
Symantec : W97M.Downloader
Tencent : Win32.Trojan.Inject.Auto
TrendMicro : W2KM_HANCITOR.AUSTT
TrendMicro-HouseCall : W2KM_HANCITOR.AUSTT

Email analysis :

NOTE : billing@secure-lgm.com
NOTE : Received : from wsip-70-165-74-172.hr.hr.cox.net
NOTE : (HELO secure-lgm.com) (70.165.74.172)

IN GOD I TRUST....212

Federal Ministry of Agriculture and Natural Resources
Address FCDA Secretariat, Garki
City Abuja
Phone +234 9 314 1931
Fax +234 9 314 2532
http://www.fmard.gov.ng/
P.M.B. 135, Garki, Abuja, FCT

Dear Friend

It is with trust and confidence that i write to make this urgent business proposal to you.i was assigned by two of my colleague to seek for a foreign partner who will assist us in providing a convenient foreign account in any designated bank abroad for the transfer of us$35,500,000.00 pending on our arrival in your country for utilization and disbursement with the owner of the account.

this amount results from a deliberate inflation of the value of a contract awarded by our ministry - the federal ministry of agriculture (F.M.A)to an expatriate company.the contract has been executed and payment made to the original contractor,remaining the over-invoiced amount of us$35.5 million,which we want to transfer the funds out the country in our favor for disbursement among ourselves.the transfer of this money can only be possible with the help of a foreigner who will be presented as the beneficiary of the fund.

as government officials, we are not allowed to operate foreign accounts,and this is the reason why we decided to contact you. we have agreed that if you/your company can act as the beneficiary of this fund (us$35,500,000.00 million)25% of the total sum will be for you for providing the account while 5% will be set aside for the expenses incurred during the cost of transfer of the fund into your account while 70% will be reserved for us.

we hereby solicit for your assistance in providing a convenient account number in a designated bank abroad where this fund would be transferred.we intend coming over there on the completion of this transfer to secure our own share of the money.

please note that we have been careful and have made all arrangements towards the success and smooth transfer of the fund to your account before you. for security reasons and confidentiality of this transaction, we demand that you should not expose this proposal and the entire transaction to anybody.

we are putting so much trust in you with the hope that you would not betray us. or sit on this money when it is finally transferred into your account.be rest assured that this transaction is 100% risk free. if this proposal is acceptable to you,indicate your interest by sending a email to us including your bank name & address,account number,telephone and fax numbers.

note:our former president Dr.Good luck Ebele Jonathan collaborated with the former chairman of the Economic Financial Crime Commission,Mrs Farida Mzamber Waziri to stop the junior ranks officers from transferring funds out of the country. he sent different publication to many countries in the world as propaganda to discourage all government officials from transferring funds into an overseas account to avoid and save guides the countries economy.

apparently, so that other government officials will not benefits from these( oil windfalls venture) where he has been a culprit alone with his aides.more details about this transaction will be given to you as soon as we receive your positive respond.

note that the particular nature of your company's business is irrelevant to this transaction. if this transaction interests you, your urgent response will be appreciated.

yours faithfully,

Dr.Evans Egobia

Email analysis :

NOTE : drevanegobia2@yahoo.com
NOTE : accdeptfedminagric1@naij.com
NOTE : mail.kapakli.bel.tr
NOTE : Received : from User (197.255.171.250)


NOTE : by MAIL.KAPAKLI.BEL.TR (192.168.34.251)
NOTE : Remote : 212.156.146.234 (mail.kapakli.bel.tr)

DHL DELIVERY COURIER COMPANY

DHL DELIVERY COURIER COMPANY
Rue no. 23 Patte D'oie 03 BP 2147 Cotonuo
Headquarter Cotonuo Benin
E-mail: shipping.unit@web.co.zw
Office Telephone: +229-66673 695

Hello my dear,

Good day and how are you today? Having reviewed all the obstacles and problems surrounding your over due inheritance funds valued $2.5Million USD (Two Million Five Hundred Thousand United States Dollars) payment and your inability to meet up with the charges required due to unnecessary protocols involved. It is my great pleasure to inform you that we have successfully arranged with UBA Bank Director, Dr. Ifeatu Onejeme to covert your above mentioned fund which was originally in a Consignment box into ATM Visa Card and ready for delivery to your door step. I am happy when UBA Bank Director, Dr. Ifeatu Onejeme called me that all the necessary arrangement has been completed that he has converted the total amount into ATM Card in your name, after which I went to DHL Courier Company and have it registered for onward delivery to your address. Kindly study bellow information for your deposit details:

Description: UBA BANK (ATM CARD)
Depositor: Linda Conti
Deposit Number: DHL-101-PL45
Deposit Certificate N0.E405576
Sort/Clearance Code: DHL/101-45/P50

According to Mrs Linda Conti, you can able to withdraw $2,500.00 per each withdrawal at daily limit of $10,000.00 until you withdraw your total $2.5Million from the ATM CARD. So all you need is to write application letter to bellow DHL Courier Company contact information or call their foreign operation department Dr Andrew Leek for immediate delivery schedule of your ATM CARD to any address of your choice.

Contact Person: Dr. Maxwell Kobo (Foreign Operation Department)
DHL Courier Company Cotonuo Benin,
Plot No. 23 Patte D'Oie 03 BP 2147 Cotonuo
Telephone Number: 00 229-666 73 695
Email: shipping.unit@web.co.zw

Don't forget to reconfirm your current data as Dr. Maxwell Kobo requested to enable their delivery agent succeed. Herein is what they need from you

1. Your Full Names:_____________
2. Postal Address:________________
3. Direct Cell Numbers:_______
4. E-mail Address:__________________
5. Sex:_____________________
6.Age:______________________
7. Occupation:__________________
8.Nationality:________________
9.Country Name________________
10.Copy of Your Passport/ Drivers Licenses________________

Please hurry up now as your package might attract more charges if it stays more than 3days with DHL and do keep me posted for record updated.

Thanks and remain blessed

Best Regards,
Mr. Johnson Williams
IMF Head Quarter Dept Reconciliation Committee
Benin Republic

Email analysis :

NOTE : zinou1959@gmail.com
NOTE : imffund65@gmail.com

pin code Number BMW:2551256003/23.

BMW LOTTERY DEPARTMENT
5070 WILSHIRE BLVD
LOS ANGELES. CA 90036
UNITED STATES OF AMERICA.

NOTE: If you received this message in your SPAM/BULK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.

Dear BMW Enthusiast,

This is to inform you that you have been selected for a prize of a brand new 2016 Model BMW 7 Series Car and a Check of $500,000.00usd from international programs held this Final quarter of 2016 in NC, UNITED STATES OF AMERICA. The selection process was carried through a random computerized selection process in our email selection system(ESS), from a database totalling over 250,000 email addresses drawn from all the continents. The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our BMW fiduciary claims department for more information as regards procedures to claim your prize.

Verification Agent: Mr. Derek Weir
Contact E-mail: der_weir@mail.com

Contact him by identifying your claim with the pin code Number BMW:2551256003/23. You are also advised to provide him with the under listed information:

1. Name in full.
2. Address.
3. Nationality.
4. Age.
5. Phone/Fax.
6. Present Country.
7. Email address.
8. pin code Number BMW:2551256003/23.

BMW CEO Harald
THE DIRECTOR PROMOTIONS

BMW SALES LOTTERY DEPARTMENT

UNITED STATES OF AMERICA

Email analysis :

NOTE : der_weir@mail.com
NOTE : eric@topperblue.com
NOTE : X-Mdremoteip : 191.55.3.165
NOTE : 114.112.79.15 (smtp14.smtp.yun-idc.com)

Anthony Dozie

Hello

I make this contact believing we will be supporting each other in developing a long lasting cordial business relationship. I am moved by my inspiration to trust you.

On August 27, 2007 one of my friends died in a car accident along Manchester motorway. Unfortunately, both driver and passenger lost their lives and my deceased friend had no wife or children before his death. I asked to find his extended relatives, no person.

Three weeks ago I noticed a letter from a Safety Deposit Centre on their plan to confiscate funds from my late friend (Valued US $ 15.5 million) if I fail to bring any relative to my deceased friend. The fact you come from his country of origin and have same last name as my deceased friend, makes you credible.

Together we will avoid confiscation of the account and claim the funds. Therefore, I have made consultation with a lawyer who can get all the necessary legal documents to back up your claims as heir, and he assured me his professional support.

Sincerely
Anthony Dozie
anthonydozie17@yahoo.com

38 Queen Street
Orrell,
Wigan WN5 0AE
England

Email analysis :

NOTE : anthonydozie17@yahoo.com
NOTE : a.d@icppa.com
NOTE : X-Mailer : IceWarp Mailer 11.4.1.5 (2016-06-08) UBUNTU1404 x64
NOTE : Received : from antirelay02.smtp.cz (antirelay02.smtp.cz. [81.95.105.132])


NOTE : Received : from icppa.com [197.210.25.145] ([127.0.0.1])


NOTE : by iw01.smtp.cz (IceWarp 11.4.1.5 (2016-06-08)
NOTE : 81.95.105.132

CANADA PROVINCIAL NOMINATION PROGRAM

CANADA PROVINCIAL NOMINATION PROGRAM
1148 Hornby Street
Vancouver, BC
V6Z 2C3

Hello Nominee,

Canada Resettlement Provincial Nomination Programs

This is to congratulate you for being selected in Canada 2016 Resettlement Provincial Nomination Programs, you are among the list of persons that have been nominated for 2016 settlement to Canada with benefits from Canada Government, you and your family will be granted settlement with benefits if you can meet the basic requirements.

Your nomination code is (PNP-CAN001201411)

Every year certain numbers of people are selected via e-mail through our electronic ballot system for resettlement by Canadian Government as part of support to some Countries.

Please confirm receipt of this notification, by responding immediately. So that we can forward the relevant requirements.

Note: If you receive this notice repeatedly, it is to ensure it delivers safely into your mailbox without failure delivery due to network problem

For further details
Contact us.
Program Coordinator
Miss Deborah Woll
cic.pnp@consultant.com

FOR MORE DETAILS
PLEASE CONTACT US VIA
Emails- cic.pnp@consultant.com

----------------------------------------------------------------------------------------------------------------------
IMPORTANT LEGAL NOTICE: The information contained in this communication is confidential, may be client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of CANADA IMMIGRATION & RESETTLEMENT BUREAU and the sender. Unauthorized use, disclosure or copying of this communication or any part thereof is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by return e-mail to cic.pnp.resettlement@post.com and destroy this communication and all copies thereof, including all attachments.
----------------------------------------------------------------------------------------------------------------------

Email analysis :

NOTE : cic.immigration.gc@gmx.com
NOTE : cic.pnp@consultant.com
NOTE : cic.pnp.resettlement@post.com
NOTE : User-Agent : Webmail INTN/0.8.2
NOTE : Organization : Canada Resettlement Provincial Nomination Programs
NOTE : Received : from mail.intn.gov.py (unknown [192.168.0.90])


NOTE : The server used to relay this scam was the "Instituto Nacional de Technologia, Normalizacion y Metrologia"

Hello Dear,


Hello Dear,

Greeting in the name of our lord jesus christ.i am mrs patricia cedillas,a widow to late timothy cedillas i am 48 year,s old. i am now a new christain convert,suffering from long time cancer of the lungs,from all indication my conditions is really deteriorating and it is quite obvious that i wont live more than 2 months,according to my doctors,this because the cancer stage has gotten to a very bad stage,my late husband was killed during u.s. raid against terrorism in afghanistan, and during the period of our marriage we could'nt produce any child. my late husband was very wealthy and after his death,i inherited all his business and wealth,the doctor has adviced me that i may not live more than two months,so i decided to devide the part of this wealth,to contribute to the development of church in africa,america,asia,and europe.

i saw your profile in web site and i prayed over it before contacting you,i am willing to donate the sum of $5,000.000.00.USD(FIVE MILLION UNITED STATE DOLLARS)to the less privileged.please i want you to note that this fund is lying in a security company and upon my instruction my attorney who is presently in cote divoire will file in an application for you,for the transfer of the money in your name,lastly i honestly pray that this money when transferd to you,will be sure for the said purpose,because i have come to find out that wealth acquisition without christ is vanity,may the grace of our lord jesus the love of God and the fellowship of God be with you and your family,

i await urgent reply.

your, in christ,mrs patricia cedillas

Email analysis :

NOTE : p9079c@yahoo.com
NOTE : patricia5cedillas@yahoo.com
NOTE : Received : from jws700024.mail.ir2.yahoo.com
NOTE : by sendmailws110.mail.ir2.yahoo.com

Investment Offer

Hello Dear,

I am obliged to open this vital business discussion with you for a possible investment partnership.

We have the capacity to provide direct business funding for large investment projects from the network of wealthy Arab Businessmen and also from the Royal Household Investment Group. Our investment capital for Europe and Asia is over USD$9 BILLION Dollars and we have the funds right there In Europe and Asia. We Have funds under management of Finance Companies in (1) Belgium(2) Holland (3) Canada (4) United States of America (USA) (5) Indonesia (6) Malaysia (7) Turkey. However, Before we provide the investment funds, We would like to submit our Memorandum of Understanding/Agreement and Terms for your consideration and endorsement.

Before that, We shall need the following information’s:

1- Telephone Numbers and Fax 404-900-2765
2- The investment Amount required. $100,000

Kindly acknowledge my email for further information on the MOU and Investment Terms.

Regards,
MR. TOBI THOMAS.
Reply Email: ( fcmtb@yahoo.com )
FIDELITY CAPITAL MANAGEMENT CORPORATION.
Website: https://www.fidelity.com/

Email analysis :

NOTE : adelsayed7777@outlook.com