Cisco Security Intelligence Operations has detected significant activity related to spam e-mail messages that claim to contain invoice information for the recipient. The text in the e-mail message attempts to persuade the recipient to open the attachment and view the details. However, the .zip attachment contains a malicious .exe file that, when executed, attempts to infect the system with malicious code.
E-mail messages that are related to this threat (RuleID4283) may contain the following files:
sample.zip
V9tZ2ah.exe
The V9tZ2ah.exe file in the sample.zip attachment has a file size of 286,720 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0x0943B5978DD27113E69454C6F6BB3FFA
The following text is a sample of the e-mail message that is associated with this threat outbreak:
Subject: Re.Invoice and production of new order. Inv. No. 201206000102
Message Body:
Greetings,
Thank you for responding to my earlier message in regards to the quotation. We do outsourcing of supplies to a number of chain stores and retailers. For reason of excessive demand, our suppliers have requested for extra help in production lines.
Please note that Quality and Similarity are crucial. We requested that you kindly download the attachment in the folder to get full details of our order including required quantity and pictures of a sample product model we have previously produced.
Once you have concluded viewing the samples, and submitting your PERFOMA INVOICE ON OUR SITE . We expect to hear from you shortly to enable us offset with the purchase arrangement/agreement/50% PAYMENT once the price is competitive and we get your assurance on the quality of the products. .(PLEASE READ OUR CONFIDENTIAL NOTICE BELOW)
Thanks,
Mr Sydney Pryce
Rezayat Trading Company Ltd.
Kuwait
Tel:+965-481 68361
CONFIDENTIALITY NOTICE
This message (including any attachments) contains information that may be confidential. Unless you are the intended recipient (or authorized to receive for the intended recipient), you may not read, print, retain, use,
copy, distribute or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by reply e-mail, and destroy all copies of the original message (including any attachments)
Cisco Security Intelligence Operations analysts examine real-world e-mail traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global e-mail security threats and trends. Cisco will continue to monitor this threat and automatically adapt IronPort systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.
Cisco IronPort Virus Outbreak Filters protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. E-mail that is managed by Cisco and end users who are protected by Cisco IronPort web security appliances will not be impacted by these attacks. Cisco IronPort appliances are automatically updated to prevent both spam e-mail and hostile web URLs from being passed to the end user.
Related Links
Cisco Security Intelligence Operations
Cisco Threat Operations Center
Cisco SenderBase Security Network
