RE: order cancellation (Virus)

My order was supposed to be delivered last week and it’s still not here.

Please refund my full amount as stated on the attached invoice I received
from [$DOMAIN].

Thanks,

Albert Trujillo

Manager of operations
2312 Montgomery St

invoice_323489.doc

File analysis :

NOTE : open invoice_323489.doc
NOTE : invoice_323489.doc is a virus.

Virus analysis :

ALYac : Trojan.Agent.BOQY
AVware : Trojan.Win32.Generic.pak!cobra
AhnLab-V3 : W97M/Agent
Arcabit : HEUR(high).VBA.Trojan
Avast : Win32:Trojan-gen
Avira : TR/Crypt.ZPACK.219008
BitDefender : Trojan.Agent.BOQY
Cyren : PWS.UKZL-52
DrWeb : Trojan.PWS.Stealer.4118
ESET-NOD32 : Win32/PSW.Fareit.A
Emsisoft : Trojan.Agent.BOQY (B)
F-Secure : Trojan.Agent.BOQY
Fortinet : WM/Agent!tr
GData : Trojan.Agent.BOQY
Ikarus : Trojan.Win32.PSW
Kaspersky : Trojan.VBS.Agent.xw
McAfee : W97M/Dropper.ah
McAfee-GW-Edition : Artemis!5E49FAB20EC4
Microsoft : TrojanDropper:O97M/Farheyt
NANO-Antivirus : Trojan.Win32.Stealer.dyyyhx
Sophos : Troj/Agent-APMP
Symantec : Trojan.Mdropper
Tencen : Win32.Trojan.Crypt.Dxnf
TrendMicro : W2KM_DRIDEX.YYSPF
TrendMicro-HouseCall : W2KM_DRIDEX.YYSPF
VIPRE : Trojan.Win32.Generic.pak!cobra
nProtect : Trojan.Agent.BOQY

Email analysis :

NOTE : accounting@michaelsav.com
NOTE : User-Agent : Mozilla/5.0 (Windows; U; Windows NT 6.1; sv-SE; rv:1.9.2.8) Gecko/20100802 Thunderbird/3.1.2
NOTE : X-REMOTE : 4.28.11.153 ()

Seeking your MOU.

Dear Sir,

My name is Mr.Maurice Siedu and I work as chief director , Agricultural Services Ghana.

I am seeking your mutual assistance to move $21.5 million fertilizer -subsidy fund to your country for a private investment and of your benefits.

Please let me know the best time to call and I will explain more details about this business.

I will be looking forward to your response.

Thanks,

Mr.Maurice Seidu,

Chief Director,

Agricultural Services Ghana.

Email analysis :

NOTE : test@fengli.net
NOTE : mseidua@outlook.com
NOTE : Received : from User (197.211.53.3)
NOTE : by FengliMail.fengli.net (10.30.6.8)

Votre caisse d'allocatiion familiales (Phishing)

Bonjour,

D'apres le bilan annuel de votre situation financiere nous vous informons que vous avez droit a une prime d'aide vacances versee par votre Caisse Allocation Familiales d'un montant de 390.90 Euro. S'il vous plait Visualisez le lien ci-dessous et fournissez toute information necessaire :

Votre Formulaire ici

En attendant le traitement de votre demande,veuillez accepter nos salutations distinguees.

© Caisse Nationale Des Allocations Familiales .

Infos legales | © Caf
Vous recevez ce message car vous nous avez communique votre adresse electronique.
Si vous ne souhaitez plus recevoir de message electronique de votre Caf a cette adresse,
veuillez le signaler dans l'espace "Mon Compte" du site www.caf.fr

Service Client
www.caf.fr

Phishing analysis :

CLICK : Votre Formulaire ici
OPEN : http://link.email.dynect.net/link.php?H=*&G=*&R=greenislandtrust.org/*
REDIRECT : http://bisnescafe.com/script/packages/vbdbsearch/*/login.php?cmd=_home&dispatch=*

dynect.net whois :

Domain Name: DYNECT.NET
Registry Domain ID: 954983178_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.dyndns.com
Registrar URL: http://dyn.com
Updated Date: 2014-12-05T16:52:48Z
Creation Date: 2007-05-03T02:58:41Z
Registrar Registration Expiration Date: 2016-05-03T02:58:41Z
Registrar: DYNAMIC NETWORK SERVICES, INC
Registrar IANA ID: 1040
Registrar Abuse Contact Email: abuse@dyn.com
Registrar Abuse Contact Phone: +1.6036684998
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant Name: Dynamic Network Services
Registrant Organization: Dyn
Registrant Street: 150 Dow St, Tower 2
Registrant City: Manchester
Registrant State/Province: NH
Registrant Postal Code: 03101
Registrant Country: US
Registrant Phone: +1.6036684998
Registrant Email: Domains@dyn.com
Registry Admin ID:
Admin Name: Dynamic Network Services
Admin Organization: Dyn
Admin Street: 150 Dow St, Tower 2
Admin City: Manchester
Admin State/Province: NH
Admin Postal Code: 03101
Admin Country: US
Admin Phone: +1.6036684998
Admin Email: Domains@dyn.com
Registry Tech ID:
Tech Name: Dynamic Network Services
Tech Organization: Dyn
Tech Street: 150 Dow St, Tower 2
Tech City: Manchester
Tech State/Province: NH
Tech Postal Code: 03101
Tech Country: US
Tech Phone: +1.6036684998
Tech Email: Domains@dyn.com
Name Server: NS1.DYNAMICNETWORKSERVICES.NET
Name Server: NS2.DYNAMICNETWORKSERVICES.NET
Name Server: NS3.DYNAMICNETWORKSERVICES.NET
Name Server: NS4.DYNAMICNETWORKSERVICES.NET
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

bisnescafe.com whois :

Domain Name: BISNESCAFE.COM
Registrar WHOIS Server: whois.dotarai.com
Registrar URL: http://www.dotarai.com
Updated Date: 2015-10-30T05:14:16Z
Creation Date: 2012-06-28T15:54:55Z
Registrar Registration Expiration Date: 2016-06-28T15:54:55Z
Registrar: DotArai Co., Ltd.
Registrar IANA ID: 1373
Registrar Abuse Contact Email: abuse@dotarai.co.th
Registrar Abuse Contact Phone: +66.25648038
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: Bisnes Cafe
Registrant Organization: Bisnescafe
Registrant Street: Karnjanapisak
Registrant City: Muang
Registrant State/Province: Bangkok
Registrant Postal Code: 10230
Registrant Country: TH
Registrant Phone: +66.
Registrant Email: bisnescafe@gmail.com
Registry Admin ID:
Admin Name: SMART SMES
Admin Street: Karnjanapisak
Admin City: Muang
Admin State/Province: Bangkok
Admin Postal Code: 10230
Admin Country: TH
Admin Phone: +66.
Admin Email: smartplannet@gmail.com
Registry Tech ID:
Tech Name: SMART SMES
Tech Street: Karnjanapisak
Tech City: Muang
Tech State/Province: Bangkok
Tech Postal Code: 10230
Tech Country: TH
Tech Phone: +66.
Tech Email: smartplannet@gmail.com
Name Server: PAUL.NS.CLOUDFLARE.COM
Name Server: GAIL.NS.CLOUDFLARE.COM
DNSSEC: Unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

Email analysis :

NOTE : notification0045@cafe.fr
NOTE : X-Vr-Srcip : 99.199.66.73
NOTE : Received : from ME-SERVER (s99-199-66-73.bc.hsia.telus.net [99.199.66.73])
NOTE : by lpn-prd-vrin016 (Postfix)

You have been gifted $1.5 MILLION USD donation fund by Susan & Mr Warren Buffet Foundations

Greetings to You

You have been gifted $1.5 MILLION USD donation fund by Susan & Mr Warren Buffet Foundations. Contact us at this email for your claim and more information: buffetwarren@yandex.com

Thanks
Warren Buffett

Grüße dich

Sie haben von Susan & Herr Warren Buffet Foundations wurden begabt $ 1,5 Millionen USD Spendenfonds. Kontaktieren Sie uns unter dieser E-Mail für Ihre Ansprüche und weitere Informationen: buffetwarren@yandex.com

Vielen Dank
Warren Buffett

Email analysis :

NOTE : WarrenBuffett
NOTE : buffetwarren@yandex.com

UNHP GRANTS

UNHP GRANTS 201523/11/2015. This is to notify you that you have been appointed as one of the recipients of a Cash Grant/Donation for your personal and community development. You were selected among the beneficiaries to receive the sum of GBP 1,100,000.00 as developmental aid from the UN Foundation. Please contact UNDP Chairman - Mrs. Anna Joshua on this email: grants2015@rthmschamber.org.uk Name in full:Address:Nationality:Age:Gender:Occupation:Cell PhonePresent country:Alternate Email Address: Note that you are to send your details to the payment department email: grants2015@rthmschamber.org.uk Regards,Chairman UNDP Grant (Mrs. Anna Joshua)

Email analysis :

NOTE : rim.sallem@telecom-paristech.fr
NOTE : grants2015@rthmschamber.org.uk
NOTE : Received : from zmail111.enst.fr (zmail111.enst.fr [137.194.5.75])
NOTE : by zproxy110.enst.fr (Postfix)

Pozdravy a pochvaly.

Pozdravy a pochvaly.

Jsem Mr.Peter Wong Pracuji s Bank of China mám obchodní návrh ve výši US $ 22.500.000 milionu, které mají být prevedeny na offshore úcet s vaší pomoc, pokud chtejí V prípade zájmu Vám pošlu všechny podrobnosti transakce na obdržení odpovedi. Mužete me kontaktovat na muj soukromý e-mail: (peterwong21@qq.com) a pošlete mi tyto informace pro úcely dokumentace

1) Úplné názvy
2) Aktuální Obytná Adresa
3) Soukromé telefonní císlo,

S prátelským pozdravem,
Mr.Peter Wong

Email analysis :

NOTE : peterwong21@qq.com
NOTE : info@demae-seminar.com
NOTE : Received : from User (tmo-101-59.customers.d1-online.com [80.187.101.59])