Sunday, August 31, 2014

You are to stop further dealings with any other office.

Attn: Beneficiary ,

Truth of the Matter.

I am compelled to write you in respect of your fund remittance, which transfer has remained unsuccessful. I am very sure that you must have lost hope of ever getting your fund transfer released especially after all the frustrations, endless disappointment and broken promises in the hands of some officials.

Based on all these and also the problems that we are having with the IMF and the FBI,with transfer of over $5.5m usd.After our meeting last week We have decided to pay you in cash through a diplomatic means.The money will be delivered to your door step in your country.

Below are required information,s need.

1. Full Names:.............................
2. Contact Address:.......................
3. Direct Telephone Number:.................

NB: You are to stop further dealings with any other office to achieve your goal.

Yours sincerely,
Dr Williams Paul
Tel: +234-81701-99940.

Mr Ray Walter

Attn,

How are you? hope all is well with you and your family. I know that you might have forgotten about this your outstanding fund due to delaying the delivery up till now. I am writing to inform you that your file was found in our office today and we discovered that your cheque of $6.6 Million united state dollars have not been sent to you as it was instructed by our late boss Mrs. Victoria Ray. We are very sorry for the mistake and the delaying, please bear with us because the fault is from our former secretary who did not complete the instruction giving by our woman. Note that your cheque has been convert into Master ATM Card to free it from Expiring. This is to inform you that the arrangement have made to deliver the $16.6 Million through ATM CARD to you the meeting is concluded last. Your ATM CARD is well packaged with everything legal documents to cover it not having any problem with any Office Authority and we have waiting to hear from you since to deliver it to your home as soon as you contact us with you current information.

(1.) Your Full name,________________
(2.) Your home Address,______________
(3.) Your current telephone number,_________
(4.) A copy of your picture,_____________
(5.) Your age/sex,____________________
(6.) Your country,________________________
(7.) Your occupation,__________________

Therefore you should contact us now to avoid wrong delivery, after some days,you should contact the ATM Center Director on this below E-mail(avis.cavallinotrepor@libero.it)

Contact Person; Dr. Oscar Christopher
Tel: Phone Number; +229-6894 3553

Please try to call him immediately to know when Your ATM CARD will be deliver to you. I wait for your update as soon as you have receive your ATM CARD Package immediately.

God Bless You.
Yours sincerely

Mr Ray Walter

my new photo ;) (Virus)

my new photo ;)
if you like my photo to send me u photo

< photo.zip >

Virus Analysis :

AVG SHeur4.CBFB 20140830
AVware Trojan.Win32.Generic!BT 20140830
Ad-Aware Trojan.Agent.BEZQ 20140830
AntiVir TR/Dropper.VB.18514 20140830
Avast Win32:Trojan-gen 20140830
BitDefender Trojan.Agent.BEZQ 20140830
ByteHero Virus.Win32.Heur.p 20140830
Cyren W32/Trojan.OVUX-2230 20140830
DrWeb BackDoor.Tishop.122 20140830
ESET-NOD32 Win32/TrojanDownloader.Zurgop.BK 20140830
Emsisoft Trojan.Agent.BEZQ (B) 20140830
F-Secure Trojan.Agent.BEZQ 20140830
GData Trojan.Agent.BEZQ 20140830
Ikarus Trojan.Inject 20140830
Kaspersky Trojan.Win32.Inject.qtsd 20140830
Malwarebytes Spyware.Zbot.ED 20140830
McAfee Dropper-FLO!01BD3D688F14 20140830
McAfee-GW-Edition Dropper-FLO!01BD3D688F14 20140830
MicroWorld-eScan Trojan.Agent.BEZQ 20140830
Sophos Troj/VB-HOC 20140830
Symantec Trojan.Smoaler 20140830
VIPRE Trojan.Win32.Generic!BT 20140830

ASM DLL Analysis :

; Imports from SHELL32.DLL
imp_SHCreateShellItem:
00401000 F4 hlt ; XREF=0x4010ae
00401001 db 0x0e
00401002 db 0x91
00401003 db 0x73
00401004 0000 add byte [ds:eax], al
00401006 0000 add byte [ds:eax], al

; Imports from NETAPI32.DLL
imp_NetGetDCName:
00401008 dd 0xffffffff ; XREF=0x4010a8
0040100c 0000 add byte [ds:eax], al
0040100e 0000 add byte [ds:eax], al

; Imports from MSVBVM60.DLL
imp_ordinal_669:
00401010 dd 0x7294a1bb ; XREF=0x40109c
imp_ordinal_598:
00401014 dd 0x72a0e0f7 ; XREF=0x40108a
imp_ordinal_631:
00401018 dd 0x72a26fe2 ; XREF=0x401090
imp_ordinal_632:
0040101c dd 0x72a2702f ; XREF=0x401096
imp_EVENT_SINK_AddRef:
00401020 dd 0x72a09b74 ; XREF=0x4010c0
imp_DllFunctionCall:
00401024 dd 0x7294a0fd ; XREF=0x401060
imp_EVENT_SINK_Release:
00401028 dd 0x72a09b87 ; XREF=0x4010c6
imp_EVENT_SINK_QueryInterface:
0040102c dd 0x72a09a85 ; XREF=0x4010ba
imp___vbaExceptHandler:
00401030 dd 0x72a247df ; XREF=0x4010b4
imp_ordinal_717:
00401034 dd 0x72a28fe9 ; XREF=0x401066
imp_ProcCallEngine:
00401038 dd 0x72a3d05d ; XREF=0x4010cc
imp_ordinal_535:
0040103c dd 0x72a1c85d ; XREF=0x401084
imp_ordinal_644:
00401040 dd 0x72a1de99 ; XREF=0x401078
imp_ordinal_648:
00401044 dd 0x72a14275 ; XREF=0x401072
imp_ordinal_578:
00401048 dd 0x72a161f8 ; XREF=0x4010a2
imp_ordinal_100:
0040104c dd 0x729435a4 ; XREF=0x4010d2
imp_ordinal_616:
00401050 dd 0x72a26d9a ; XREF=0x40106c
imp_ordinal_544:
00401054 dd 0x72a11c93 ; XREF=0x40107e

Saturday, August 30, 2014

Diplomat William Cassello

Attention:Beneficiary,

I am Diplomat William Cassello , mandated to deliver your inheritance/contract sum to you in your country of residence. The funds total US$15.5 Million and you were made the beneficiary of these funds by a benefactor whose details will be revealed to you after handing over the funds to you in accordance with the Agreement I signed with the benefactor when he enlisted my assistance in delivering the funds to you. I am presently in your country and I have just left the International Airport to the storage house where will be conducive for the fund before proceeding to your resident and before I can deliver the package (funds) to you, you have to reconfirm the following information so as to ensure that I am dealing with the right person:

Your Complete Names as illustrated herein: Surname/ Middle Name/ Other Names
2. Residential Address
3. Age
4. Occupation
5. Direct cell phone Numbers
6. A Copy of Your Identification

Contact Telephone Numbers. This number has to be a working number and a number where you can be reached easily. You will be called on the number by the delivery agent before the funds is handed over to you. So, its important that you provide a working number for easy communication. If your number is on voice mail, remove it immediately so that the officer can speak to you. We therefore want to use this medium to apologize for any inconvenience the delay in releasing the funds may have caused you and your family. After verification of the information with what I have on file, I shall contact you so that we can make arrangements on the exact time I will be bringing your package to your residential address. Send the requested information so that we can proceed.

Regards

Diplomat William Cassello
DELIVERY SERVICES AGENT, U.S.A.
Tel:940-602-8690

Rép : Thank you for your past effort.

Dear Friend

I wish to inform you that I finally succeeded in transferring the US$3.8 million to Japan where i am residing presently with my only son. I decided to compensate you for your efforts in this transaction with the sum of $450,000 dollars which i made out in an ATM Card and kept it with my spiritual father for you. Kindly Contact him immediately on the contact details described below;

Rev. Father John Clegg
St. Mark Church of England
Phone: +234 909 994 4189
E-mail: rev.jclegg@yahoo.com

He Will send your ATM Card to you without delay. I thank you once more for all your time and effort.

Best regard
Dr. Larry Smith

Rép : Your urgent attention will be required.

Hello Beneficiary,

How are you today? We have been mandated to transfer your funds to your nominated Bank account in your country, please re-confirm to us you are the rightful beneficiary before we can proceed accordingly. Therefore, also affirm to us how much you're being owed by the African Bank for our final scrutiny to release your funds. Your full name, address and telephone number will be required as well for preparing the final fund's release order document.

Your urgent attention is required.

Robert