Notice to Appear,
This is to inform you to appear in the Court on the September 02 for your case hearing. You are kindly asked to prepare and bring the documents relating to the case to Court on the specified date.
Note: The case may be heard by the judge in your absence if you do not come.
The copy of Court Notice is attached to this email.
Regards,
Gary Noble,
Court Secretary.
000475484.zip
File analysis :
OPEN : 000475484.zip
RESULT : File is a virus.
Virus analysis :
SHA256 : 0c8d2b8cba6611097793124c3dac9e9313207ba8857b41330ca021c89f52c82f
ALYac : JS:Trojan.JS.Downloader.AN
AVG : JS/Downloader.Agent
AVware : Malware.JS.Generic (JS)
Ad-Aware : JS:Trojan.JS.Downloader.AN
Arcabit : JS:Trojan.JS.Downloader.AN
Avast : JS:Agent-DOB [Trj]
BitDefender : JS:Trojan.JS.Downloader.AN
CAT-QuickHeal : JS.Downloader.Z
Comodo : Heur.Dual.Extensions
DrWeb : SCRIPT.Virus
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AV
Emsisoft : JS:Trojan.JS.Downloader.AN (B)
F-Secure : JS:Trojan.JS.Downloader.AN
Fortinet : JS/Agent.CPL!tr
GData : JS:Trojan.JS.Downloader.AN
Kaspersky : Trojan-Downloader.JS.Agent.hhe
McAfee : JS/Nemucod.c
McAfee-GW-Edition : JS/Nemucod.c
Microsoft : TrojanDownloader:JS/Nemucod.P
NANO-Antivirus : Trojan.Script.Agent.dtchtk
Rising : NORMAL:Trojan.DL.Script.JS.Nemucod.b!1616509[F1]
Sophos : JS/DwnLdr-MON
VIPRE : Malware.JS.Generic (JS)
nProtect : JS:Trojan.JS.Downloader.AN
Email analysis :
NOTE : Notice to Appear
NOTE : gary.noble@wayneshostingworld.co.uk
NOTE : Received : from doggroom by server.wayneshostingworld.co.uk with local (Exim 4.85)
NOTE : Received : from server.wayneshostingworld.co.uk (wayneshostingworld.co.uk. [78.129.234.106])
NOTE : X-Php-Script : doggroomingparlour.co.uk/post.php for 77.111.207.70
Monday, August 31, 2015
Invoice Jeff Herman
invoice53444271 Jeff Herman.zip
File analysis :
OPEN : invoice53444271 Jeff Herman.zip
RESULT : File is a virus.
Virus analysis :
SHA256: 9c6ce032c5b4f521b0ace607a50a499812ecb9845741862a0f7f9183a87c7c49
ALYac : Trojan.Agent.BMBU
AVG : FakeAlert
AVware : Trojan.Win32.Generic!BT
Ad-Aware : Trojan.Agent.BMBU
Agnitum : Trojan.DL.Dofoil!MdY5QMP4IPM
Arcabit : Trojan.Agent.BMBU
Avast : Win32:Trojan-gen
Baidu-International : Trojan.Win32.Dofoil.bstr
BitDefender : Trojan.Agent.BMBU
CAT-QuickHeal : TrojanDownloader.Upatre.r4
Cyren : W32/Trojan3.RIE
ESET-NOD32 : a variant of Win32/Kryptik.DUYG
Emsisoft : Trojan.Agent.BMBU (B)
F-Prot : W32/Trojan3.RIE
F-Secure : Trojan.Agent.BMBU
Fortinet : W32/Kryptik.DUMX!tr
GData : Trojan.Agent.BMBU
Ikarus : Trojan-Downloader.Win32.Upatre
Jiangmin : TrojanDownloader.Dofoil.bhq
K7AntiVirus : Trojan ( 004cddfe1 )
K7GW : Trojan ( 004cddfe1 )
Kaspersky : Trojan-Downloader.Win32.Dofoil.bstr
Malwarebytes : Spyware.Dyre
McAfee : Upatre-FACE!67B2464F5D77
McAfee-GW-Edition : Upatre-FACE!67B2464F5D77
MicroWorld-eScan : Trojan.Agent.BMBU
Microsoft : TrojanDownloader:Win32/Upatre
NANO-Antivirus : Trojan.Win32.Dyre.dvrjgu
Panda : Trj/CI.A
Qihoo-360 : HEUR/QVM19.1.Malware.Gen
Sophos : Troj/Upatre-LD
TrendMicro : TROJ_UP.10D6D122
TrendMicro-HouseCall : TROJ_UP.10D6D122
VBA32 : Heur.Trojan.Hlux
VIPRE : Trojan.Win32.Generic!BT
ViRobot : Trojan.Win32.Upatre.43520.A[h]
Zillya : 'Downloader.UpatreGen.Win32.68
nProtect : Trojan.Agent.BMBU
Email analysis :
NOTE : bespalov@stati.orene.ru
NOTE : Received : by stati.orene.ru (Postfix, from userid 5001)
NOTE : 94.79.7.6 ()
Thursday, August 27, 2015
Indebtedness for driving on toll road #000948265 (Virus)
Notice to Appear,
You have not paid for driving on a toll road.
You are kindly asked to pay your debt as soon as possible.
The copy of the invoice is attached to this email.
Sincerely,
Thomas Gorman,
E-ZPass Agent.
E-ZPass_Invoice_000948265.zip
File analysis :
OPEN FILE : E-ZPass_Invoice_000948265.zip
RESULT : FILE IS A VIRUS
Virus analysis :
SHA256 : 5ec5b13bbf1d2a2179168acfaec53da59afa6b8ca480930e1b56d996b51dd140
ALYac : JS:Trojan.JS.Downloader.AN
AVG : JS/Downloader.Agent
AVware : Malware.JS.Generic (JS)
Ad-Aware : JS:Trojan.JS.Downloader.AN
Arcabit : JS:Trojan.JS.Downloader.AN
Avast : JS:Agent-DOB [Trj]
BitDefender : JS:Trojan.JS.Downloader.AN
CAT-QuickHeal : JS.Downloader.Z
Comodo : Heur.Dual.Extensions
DrWeb : SCRIPT.Virus
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AS
Emsisoft : JS:Trojan.JS.Downloader.AN (B)
F-Secure : JS:Trojan.JS.Downloader.AN
Fortinet : JS/Agent.CPL!tr
GData : JS:Trojan.JS.Downloader.AN
Kaspersky : Trojan.JS.Agent.cpl
McAfee : JS/Nemucod.c
McAfee-GW-Edition : JS/Nemucod.c
MicroWorld-eScan : JS:Trojan.JS.Downloader.AN
Microsoft : TrojanDownloader:JS/Nemucod.P
NANO-Antivirus : Trojan.Script.Agent.dtchtk
Rising : NORMAL:Trojan.DL.Script.JS.Nemucod.b!1616509[F1]
Sophos : JS/DwnLdr-MON
VIPRE : Malware.JS.Generic (JS)
nProtect : JS:Trojan.JS.Downloader.AN
Email analysis :
NOTE : thomas.gorman@jerusalem.hostyou.com.br
NOTE : client-ip=104.238.195.142;
NOTE : Sender Address Domain - jerusalem.hostyou.com.br
NOTE : X-Source-Args : /usr/bin/php /home/centova/public_html/coisaseria.com.br/post.php
NOTE : < centova@jerusalem.hostyou.com.br >
NOTE : Mime-Version : 1.0
NOTE : X-Source-Dir : centova.com:/public_html/coisaseria.com.br
NOTE : X-Priority : 3
NOTE : X-Get-Message-Sender-Via : jerusalem.hostyou.com.br:
NOTE : authenticated_id: centova/primary_hostname/system user
NOTE : X-Source : /usr/bin/php
NOTE : Received : by 10.202.17.82 with SMTP
NOTE : Received : from centova by jerusalem.hostyou.com.br
NOTE : Indebtedness for driving on toll road #000948265
You have not paid for driving on a toll road.
You are kindly asked to pay your debt as soon as possible.
The copy of the invoice is attached to this email.
Sincerely,
Thomas Gorman,
E-ZPass Agent.
E-ZPass_Invoice_000948265.zip
File analysis :
OPEN FILE : E-ZPass_Invoice_000948265.zip
RESULT : FILE IS A VIRUS
Virus analysis :
SHA256 : 5ec5b13bbf1d2a2179168acfaec53da59afa6b8ca480930e1b56d996b51dd140
ALYac : JS:Trojan.JS.Downloader.AN
AVG : JS/Downloader.Agent
AVware : Malware.JS.Generic (JS)
Ad-Aware : JS:Trojan.JS.Downloader.AN
Arcabit : JS:Trojan.JS.Downloader.AN
Avast : JS:Agent-DOB [Trj]
BitDefender : JS:Trojan.JS.Downloader.AN
CAT-QuickHeal : JS.Downloader.Z
Comodo : Heur.Dual.Extensions
DrWeb : SCRIPT.Virus
ESET-NOD32 : JS/TrojanDownloader.Nemucod.AS
Emsisoft : JS:Trojan.JS.Downloader.AN (B)
F-Secure : JS:Trojan.JS.Downloader.AN
Fortinet : JS/Agent.CPL!tr
GData : JS:Trojan.JS.Downloader.AN
Kaspersky : Trojan.JS.Agent.cpl
McAfee : JS/Nemucod.c
McAfee-GW-Edition : JS/Nemucod.c
MicroWorld-eScan : JS:Trojan.JS.Downloader.AN
Microsoft : TrojanDownloader:JS/Nemucod.P
NANO-Antivirus : Trojan.Script.Agent.dtchtk
Rising : NORMAL:Trojan.DL.Script.JS.Nemucod.b!1616509[F1]
Sophos : JS/DwnLdr-MON
VIPRE : Malware.JS.Generic (JS)
nProtect : JS:Trojan.JS.Downloader.AN
Email analysis :
NOTE : thomas.gorman@jerusalem.hostyou.com.br
NOTE : client-ip=104.238.195.142;
NOTE : Sender Address Domain - jerusalem.hostyou.com.br
NOTE : X-Source-Args : /usr/bin/php /home/centova/public_html/coisaseria.com.br/post.php
NOTE : < centova@jerusalem.hostyou.com.br >
NOTE : Mime-Version : 1.0
NOTE : X-Source-Dir : centova.com:/public_html/coisaseria.com.br
NOTE : X-Priority : 3
NOTE : X-Get-Message-Sender-Via : jerusalem.hostyou.com.br:
NOTE : authenticated_id: centova/primary_hostname/system user
NOTE : X-Source : /usr/bin/php
NOTE : Received : by 10.202.17.82 with SMTP
NOTE : Received : from centova by jerusalem.hostyou.com.br
NOTE : Indebtedness for driving on toll road #000948265
Hi Comrade!
Hi Comrade!
Good tidings to you, With urgent need for assistance, I have summoned up courage to contact you. I have no intention of contacting you at this moment rather an emergency prompted me to seek for urgent gateway and i will be glad if you can be of assistance in understanding my personal experience and work with you presently with my on-going military mission here in Afghanistan which is going to be fruitful and profitable to both of us financially. I am Capt.Elizabeth an officer in the US Army and the International security Assistance Force Officer (ISAF) with the Forward Operating Base Shank, Kandahar city of Afghanistan, for Peace keeping force. I am presently in Service now and i really need your help in assisting me with the safe keeping of two truks. I hope you can be trusted? I will explain further when i get a response from you.
This are the information s I need from you to keep the trust.
Your full name
Home and office address
Sex/age/occupation
Telephone
Your scanned I.D Card for identification Purpose only.
Once I receive this information I shall enclose to you on how to get the package asap.
May God be with you.
Capt.Elizabeth.
Email analysis :
NOTE : capt.elizabetmcnamara@usa.net
NOTE : capt.elizabetmcnamara@mail.tj
NOTE : Received : from User (unknown [95.170.141.11])
NOTE : by mail1.strb.ru (Postfix) with ESMTP
NOTE : Tomsk is far from Kandahar...
Good tidings to you, With urgent need for assistance, I have summoned up courage to contact you. I have no intention of contacting you at this moment rather an emergency prompted me to seek for urgent gateway and i will be glad if you can be of assistance in understanding my personal experience and work with you presently with my on-going military mission here in Afghanistan which is going to be fruitful and profitable to both of us financially. I am Capt.Elizabeth an officer in the US Army and the International security Assistance Force Officer (ISAF) with the Forward Operating Base Shank, Kandahar city of Afghanistan, for Peace keeping force. I am presently in Service now and i really need your help in assisting me with the safe keeping of two truks. I hope you can be trusted? I will explain further when i get a response from you.
This are the information s I need from you to keep the trust.
Your full name
Home and office address
Sex/age/occupation
Telephone
Your scanned I.D Card for identification Purpose only.
Once I receive this information I shall enclose to you on how to get the package asap.
May God be with you.
Capt.Elizabeth.
Email analysis :
NOTE : capt.elizabetmcnamara@usa.net
NOTE : capt.elizabetmcnamara@mail.tj
NOTE : Received : from User (unknown [95.170.141.11])
NOTE : by mail1.strb.ru (Postfix) with ESMTP
NOTE : Tomsk is far from Kandahar...
Pls provide the following details
Dear Sir / Madam,
I am interested in purchasing your products , which sample image is attached to below Login link. Please follow the link below Login link to view the sample image I am interested to order from your company, and we sincerely hope to establish a long-term business relation with your esteemed company. Click Here to login: http://www.ptss.edu.my/v6/administrator/templates/system/documents.html If so kindly, provide the following details, send me your latest catalog. Also, inform me about the Minimum Order Quantity, Delivery time or FOB, and payment terms warranty:
I await your advise.
Best Wishes,
Mrs. Linda Yong
Analysis :
CLICK : LINK
VALIDATE : FORM
RESULT :
Email analysis :
NOTE : bencook551127@yahoo.co.id
NOTE : Return-Path : spam@practicenet.co.uk
NOTE : X-Ms-Exchange-Crosstenant-Fromentityheader : HybridOnPrem
NOTE : X-Msmail-Priority : Normal
NOTE : Pls provide the following details
I am interested in purchasing your products , which sample image is attached to below Login link. Please follow the link below Login link to view the sample image I am interested to order from your company, and we sincerely hope to establish a long-term business relation with your esteemed company. Click Here to login: http://www.ptss.edu.my/v6/administrator/templates/system/documents.html If so kindly, provide the following details, send me your latest catalog. Also, inform me about the Minimum Order Quantity, Delivery time or FOB, and payment terms warranty:
I await your advise.
Best Wishes,
Mrs. Linda Yong
Analysis :
CLICK : LINK
VALIDATE : FORM
RESULT :
Email analysis :
NOTE : bencook551127@yahoo.co.id
NOTE : Return-Path : spam@practicenet.co.uk
NOTE : X-Ms-Exchange-Crosstenant-Fromentityheader : HybridOnPrem
NOTE : X-Msmail-Priority : Normal
NOTE : Pls provide the following details
Urgent Inquiry Arrival From Alibaba . (Alibaba Phishing)
logo The following message was generated before 18 Aug 2015 09:32(PST) This message was sent to you only Registered Location and Message Origin: UAE Message IP: 180.2685.4093.*
Ahmad Yacoob has sent you a new message.
Ahmad Yacoob
General inquiry about your product for sale.
18 Aug 2015 09:32
Congratulations! You have received a new inquiry From Ahmad Yacoob .To see the content and reply to this inquiry, please click on the Check Inquiry button below. Regards. Reply Now Reject Inquiry Report Spam If you don't want to reply to this inquiry, you can Reject Inquiry and let the buyer know. Learn more
Alibaba.com shall not be liable for any lost profits or incidental, consequential or other damages arising out of or in connection with this message, our web site content, our services or the activities of any of the users of our web site. Thank you for your understanding and cooperation.
Phishing analysis :
CLICK : Reply Now
OPEN : http://ledkuutio.fi/alib/index.html
RESULT : Phishing was removed...
Email analysis :
NOTE : md15m@my.fsu.edu
NOTE : X-Ms-Exchange-Crosstenant-Fromentityheader : Hosted
NOTE : Return-Path : md15m@my.fsu.edu
NOTE : X-Originating-Ip : [74.208.68.233]
NOTE : Mime-Version : 1.0
NOTE : domain of md15m@my.fsu.edu designates 157.56.111.246 as permitted sender
NOTE : smtp.mailfrom=md15m@my.fsu.edu
NOTE : X-Originatororg : my.fsu.edu
NOTE : Received-Spf : client-ip=157.56.111.246;
NOTE : Received : from u18097758.onlinehome-server.com (74.208.68.233)
NOTE : Urgent Inquiry Arrival From Alibaba .
Ahmad Yacoob has sent you a new message.
Ahmad Yacoob
General inquiry about your product for sale.
18 Aug 2015 09:32
Congratulations! You have received a new inquiry From Ahmad Yacoob .To see the content and reply to this inquiry, please click on the Check Inquiry button below. Regards. Reply Now Reject Inquiry Report Spam If you don't want to reply to this inquiry, you can Reject Inquiry and let the buyer know. Learn more
Alibaba.com shall not be liable for any lost profits or incidental, consequential or other damages arising out of or in connection with this message, our web site content, our services or the activities of any of the users of our web site. Thank you for your understanding and cooperation.
Phishing analysis :
CLICK : Reply Now
OPEN : http://ledkuutio.fi/alib/index.html
RESULT : Phishing was removed...
Email analysis :
NOTE : md15m@my.fsu.edu
NOTE : X-Ms-Exchange-Crosstenant-Fromentityheader : Hosted
NOTE : Return-Path : md15m@my.fsu.edu
NOTE : X-Originating-Ip : [74.208.68.233]
NOTE : Mime-Version : 1.0
NOTE : domain of md15m@my.fsu.edu designates 157.56.111.246 as permitted sender
NOTE : smtp.mailfrom=md15m@my.fsu.edu
NOTE : X-Originatororg : my.fsu.edu
NOTE : Received-Spf : client-ip=157.56.111.246;
NOTE : Received : from u18097758.onlinehome-server.com (74.208.68.233)
NOTE : Urgent Inquiry Arrival From Alibaba .
Subscribe to:
Posts (Atom)