Products & Services
Support

Product Categories


Popular Downloads


Manage Software

How to Buy

For Home

Linksys Products Store
Linksys is now part of Belkin
Products for everyone

All Ordering Options

Training & Events Partners
Guest

Threat Outbreak Alert

Threat Outbreak Alert: Fake Money Transfer Notification Email Messages on April 7, 2014

 
Threat Type:IntelliShield: Threat Outbreak Alert
IntelliShield ID:26690
Version:78
First Published:2012 August 20 19:55 GMT
Last Published:2014 April 08 13:28 GMT
Port: Not available
Urgency:Possible use
Credibility:Confirmed
Severity:Mild Damage
 
 
Version Summary:Cisco Security has detected significant activity on April 7, 2014.
 

Description
 
Cisco Security has detected significant activity related to spam email messages that claim to contain a copy of a money transfer receipt for the recipient. The email message instructs the recipient to open the .zip attachment to view the details. However, the .zip attachment contains a malicious .scr or .exe file that, when executed, attempts to infect the system with malicious code.

Email messages that are related to this threat (RuleID4466, RuleID4466KVR, RuleID4466KVR_1KVR, RuleID4466_1KVR, RuleID4626_2KVR and RuleID4626KVR) may contain any of the following files:

PSCopy.zip
PSCopy.scr
TT578940124.zip
TT578945554.scr
PAYMENT SLIP 1.zip
TTcopy.exe
TTcopy.zip
TT_Copy.zip
TT Copy.scr
USD 12,000.exe
TT_COPY.exe
Vodafone_MMS.exe
Vodafone_MMS-ID758283.zip
tt Copy.zip
image.scr
Swift Copy.zip
Swift Copy.exe
Swift Copy(2).zip
T T Swift COPY.zip
starsget.scr
USD 32,000.zip
USD 32,000.exe
TT.zip
TT.exe
T.T COPY.exe
T.T COPY.zip
TT COPY.exe
purchase order.zip
TT Copy.exe
payment.zip
Bank Instruction.exe
Bank Instructions.exe
tt_copies.zip
tt copy 2.exe
Confirm Order and Payment Copy.zip
Confirm Order and Payment Copy.scr
PAYMENT INSTRUCTION COPY (1).zip
SWIFT COPY.scr
PAYMENT.exe
Bank Instructions.exe
reattachcopy464.zip
reattachcopy464.exe
REMIT BANK COPY.zip
REMIT BANK COPY.scr
USD12,908.zip
USD12,908.exe
PAYMENT TT COPY.zip
PAYMENT TT COPY.exe
Transfer Copy.scr
swift copy.zip
swift copy.exe
irspolicy.zip
irspolicy.pif
SWift T.T COPY.zip
Swift T.T COPY.exe
TTswiftcopy.zip
TTswiftcopy.exe
TT Copy(1).zip
TT COPY FROM ICBC BANK.zip
Scan001.exe
TT INVOICE C1500V.zip
Document.exe
invoice copy.zip
invoice copy.exe
Xtractor_-_Copy.zip
Xtractor - Copy.exe
payment copy.zip
P.O.scr
New Order.exe
PaymentCopy.scr
HSBC_06192013_389123.zip
HSBC_06192013_389123.exe
TT COPY For New Order.zip
TT COPY For New Order.scr
RFQ.zip
TT Copy.zip
ttok.zip
ok.eTT copy.scrxe
TT copy and new order.zip
lmlm.scr
TT swift copy and new order.zip
Invoice.scr
TT Copyy.zip
TT Copyy.pdf.scr
Payment-T T COPY-.zip
Payment-T T COPY-.exe
HSBC_Docs_18072013.zip
HSBC_Docs_18072013.exe
Invoice_3289981_381.zip
Invoice_3289981_381.exe
tt payment.zip
tt payment.scr
Attachments_2013718.zip
photo.scr
tt-copy.zip
tt-copy.scr
DONE.exe
SwiftCopyReceipt20082013.zip
SwiftCopyReceipt20082013.scr
TT slip.zip
TT slip.exe

PaymentCopy.zip
payment slip.zip
Order.exe
USD 56,090.zip
USD 56,090.exe
SWIFT TT.zip
SWIFT TT.exe 

The PSCopy.scr file in the PSCopy.zip attachment has a file size of 211,968 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0x9B512C134BF5054431393E10A25CF33C

The TTcopy.exe file in the PAYMENT SLIP 1.zip attachment has a file size of 205,312 bytes. The MD5 checksum is the following string: 0xE065F478DDF65BBF2EC1D38354105836

The USD 12,000.exe file in the Copy.zip attachment has a file size of 195,584 bytes. The MD5 checksum is the following string: 0xB6D198EBBCE17AA19FC1298CD9A35E3B

The TT_COPY.exe file in the TT_COPY.zip attachment has a file size of 421,888 bytes. The MD5 checksum is the following string: 0x72140C9D851C5512E9E3DA73FE47A398

The Vodafone_MMS.exe file in the Vodafone_MMS-ID758283.zip attachment has a file size of 54,784 bytes. The MD5 checksum is the following string: 0x8952581880A63F0B064D75BCEFF8EC3A

The image.scr file in the tt Copy.zip attachment has a file size of 475,188 bytes. The MD5 checksum is the following string: 0x735D8341D88E1A0AA54E9EB9703AAEE4

The Swift Copy.exe file in the Swift Copy.zip archive has a file size of 291,328 bytes. The MD5 checksum is the following string: 0xE6F7DDEC153830ACC28483125CC2FAAD

The TT Copy.scr file in the TT Copy.zip attachment has a file size of 320,000 bytes. The MD5 checksum is the following string: 0xB530819DDBC7E6D31E0DC15BAA9C5331

The starsget.scr file in the T T Swift COPY.zip attachment has a file size of 492,032 bytes. The MD5 checksum is the following string: 0x880D5B3E1EA5838300B63A72C7262839

The USD 32,000.exe file in the USD 32,000.zip attachment has a file size of 929,717 bytes. The MD5 checksum is the following string: 0xA8BB952C4060C4F176A5EA95BC7ABFFA

The TT.exe file in the TT.zip attachment has a file size of 237,158 bytes. The MD5 checksum is the following string: 0x899BA4483F088FA433F0FF796707AA15.

The T.T COPY.exe file in the T.T COPY.zip attachment has a file size of 444,955 bytes. The MD5 checksum is the following string: 0xE73E57CD1B8429906F7A5DD437690921

The TT Copy.exe file in the TT Copy.zip attachment has a file size of 956,751 bytes. The MD5 checksum is the following string: 0xD82E5CD38F2D670C17D3281ACF77DE52

A variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 159,744 bytes. The MD5 checksum is the following string: 0x0F46329A818C694F2C810C54991C0965

A third variant of the TT Copy.exe file in the Swift Copy.zip attachment has a file size of 363,520 bytes. The MD5 checksum is the following string: 0x312D94C5CB82C533D39ABC75DFBEEE95

A variant of the TT Copy.scr file in the TT Copy.zip attachment has a file size of 508,278 bytes. The MD5 checksum is the following string: 0xAC4CD1F7B330D4DC609B96DB6AAC18F9

The TT COPY.exe file in the TT COPY.zip attachment has a file size of 546,816 bytes. The MD5 checksum is the following string: 0xB221F2FD23E992232F86A117E90FBF38

The Bank Instruction.exe file in the TT COPY.zip attachment has a file size of 273,920 bytes. The MD5 checksum is the following string: 0x66C18EDFBC9668BEE1782F4BFB4715C9

A variant of the TT COPY.exe file in the TT COPY.zip attachment has a file size of 451,101 bytes. The MD5 checksum is the following string: 0x578B400310DA8092151E4A72B11A56DC

A third variant of the TT COPY.exe file in the TT COPY.zip attachment has a file size of 451,101 bytes. The MD5 checksum is the following string: 0x578B400310DA8092151E4A72B11A56DC

The Bank Instructions.exe file in the TT Copy.zip attachment has a file size of 341,504 bytes. The MD5 checksum is the following string: 0xE8FAF6B9FB26D05F9E16FB2400BCC7F4

A fourth variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 146,432 bytes. The MD5 checksum is the following string: 0xF694B7C7512D1ACD8B7A013A099ED53F

A third variant of the TT Copy.scr file in the TT Copy.zip attachment has a file size of 1,417,216 bytes. The MD5 checksum is the following string: 0xCF01D4270CBAFAC471A72F1404CAF980

The tt copy 2.exe file in the tt_copies.zip attachment has a file size of 970,752 bytes. The MD5 checksum is the following string: 0x845AF34D48B2E6723C4C591940307CB

The Confirm Order and Payment Copy.scr file in the Confirm Order and Payment Copy.zip attachment has a file size of 283,136 bytes. The MD5 checksum is the following string: 0xC177E80FDF76B579DD9A481770ACE06B

A variant of the Swift Copy.exe file in the Swift Copy(2).zip attachment has a file size of 386,048 bytes. The MD5 checksum is the following string: 0x972A1C83525C793CE6E126726073319C

A fifth variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 465,767 bytes. The MD5 checksum is the following string: 0x57B7B21C4BBFF49E67DF25F981DFFC0C

The SWIFT COPY.scr file in the PAYMENT INSTRUCTION COPY (1).zip attachment has a file size of 466,944 bytes. The MD5 checksum is the following string: 0x09BF0BFA1967D32CD64228970E039BAE

A fourth variant of the TT COPY.exe file in the TT Copy.zip attachment has a file size of 696,783 bytes. The MD5 checksum is the following string: 0x7753076EECD90246CF26C0011D31395E

A third variant of the Swift Copy.exe file in the Swift COpy.zip attachment has a file size of 420,864 bytes. The MD5 checksum is the following string: 0x86D8CD6FB359F5744AE847263FA93F0B

A fourth variant of the TT Copy.scr file in the TT Copy.zip attachment has a file size of 1,088,471 bytes. The MD5 checksum is the following string: 0x05FCB4476D7E03DEE43A79D5BCAEB3A9

A fifth variant of the TT Copy.scr file in the TT Copy.zip attachment has a file size of 1,466,368 bytes. The MD5 checksum is the following string: 0xFD5DA15B99B4E54B58D51542FF579D2D

The PAYMENT.exe file in the TT COPY.zip attachment has a file size of 143,188 bytes. The MD5 checksum is the following string: 0x5D96D5EA00D632865B4FF6FC26E8CBD9

A sixth variant of TT Copy.exe file in the purchase order.zip attachment has a file size of 628,901 bytes. The MD5 checksum is the following string: 0xCD5FCEF12C99559945D2229DA72E57C7

A seventh variant of TT Copy.exe file in the TT Copy.zip attachment has a file size of 420,352 bytes. The MD5 checksum is the following string: 0xB37A84CA0DFD5FEDB068D3EDD926B24D

The Bank Instructions.exe file in the TT Copy.zip attachment has a file size of 308,224 bytes. The MD5 checksum is the following string: 0xA60A50BC75937DB3AD6E4618F305619D

A sixth variant of the TT copy.scr file in the TT copy.zip attachment has a file size of 493,151 bytes. The MD5 checksum is the following string: 0xAAEC5FE55957C5FDB4061A3B694D7D71

The reattachcopy464.exe file in the reattachcopy464.zip attachment has a file size of 241,664 bytes. The MD5 checksum is the following string: 0xED9E62754EF45B1560288B0A0F1515E5

The REMIT BANK COPY.scr file in the REMIT BANK COPY.zip attachment has a file size of 448,278 bytes. The MD5 checksum is the following string: 0x588F141331F51289A56EF1533CBA15CE

An eighth variant of the TT Copy.exe file in the TT_Copy.zip attachment has a file size of 1,148,091 bytes. The MD5 checksum is the following string: 0x7B4C94C296778392540F0436425EFD24

The USD12,908.exe file in the USD12,908.zip attachment has a file size of 947,605 bytes. The MD5 checksum is the following string: 0x9BE126E8968A4460FE439FA887CAD17E

The PAYMENT TT COPY.exe file in the PAYMENT TT COPY.zip attachment has a file size of 978,944 bytes. The MD5 checksum is the following string: 0xC3BE8AB6806F240F0254BEFCAB2BB0B8

The Transfer Copy.scr file in the TT Copy.zip attachment has a file size of 917,509 bytes. The MD5 checksum is the following string: 0x1548B67D5BE8EBBCE17906D9ED21EC18

The swift copy.exe file in the swift copy.zip attachment has a file size of 340,480 bytes. The MD5 checksum is the following string: 0x5C75A95843CC195BD153D0C371A42716

The irspolicy.pif file in the irspolicy.zip attachment has a file size of 722,424 bytes. The MD5 checksum is the following string: 0x0F9882D4AD7F088FD420EAE419357CBF

A seventh variant of TT COPY.scr file in the TT COPY.zip attachment has a file size of 520,704 bytes. The MD5 checksum is the following string: 0xEE60A4F2B58267056697003E958CDA4F

The Swift T.T COPY.exe file in the SWift T.T COPY.zip attachment has a file size of 287,559 bytes. The MD5 checksum is the following string: 0x8B9EF37960AE204C2D8EC06F6B704E33

A ninth variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 1,223,967 bytes. The MD5 checksum is the following string: 0x1BCA549DA3261AECB3F19D9631F2F868

The TTswiftcopy.exe file in the TTswiftcopy.zip attachment has a file size of 313,680 bytes. The MD5 checksum is the following string: 0x74B8E72C3FBA52E9872EDA9EAD586B9F

A tenth variant of the TT Copy.exe file in the TT Copy(1).zip attachment has a file size of 2,039,151 bytes. The MD5 checksum is the following string: 0xE8F28276A01BD08C5C83FEF3E7FBCC46

An 11th variant of the TT Copy.exe file in the TT COPY FROM ICBC BANK.zip attachment has a file size of 1,323,887 bytes. The MD5 checksum is the following string: 0xE4BD892AA3CD64ACAA7D1732CD602D74

The Scan001.exe file in the TT Copy.zip attachment has a file size of 3,103,537 bytes. The MD5 checksum is the following string: 0x2EBE84BF3DCEBFAF6B9000A778DA92BE

A 12th variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 1,285,937 bytes. The MD5 checksum is the following string: 0x16DAFFD5C4B96B9BEDB3102D8E707FDF

The Document.exe file in the TT INVOICE C1500V.zip attachment has a file size of 3,706,880 bytes. The MD5 checksum is the following string: 0x737893429462696AD451C5ACF6168557

The invoice copy.exe file in the invoice copy.zip attachment has a file size of 487,510 bytes. The MD5 checksum is the following string: 0xC0CD532FBF5EDA8A41AC77B89A37E02E

The Xtractor - Copy.exe file in the Xtractor_-_Copy.zip attachment has a file size of 540,672 bytes. The MD5 checksum is the following string: 0x7ADBF91BC8C99312A6958AC749CE7190

A 13th variant of the tt copy.exe file in the payment.zip attachment has a file size of 291,328 bytes. The MD5 checksum is the following string: 0xA24013CEC6C7B00704BE7CCD2D7335F5

The P.O.scr file in the payment copy.zip attachment has a file size of 1,010,023 bytes. The MD5 checksum is the following string: 0xA48D64AD5F04ED6752249747A596CC41

A 14th variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 1,323,887 bytes. The MD5 checksum is the following string: 0x7E160F0805391B7AB3D6AF10841B76EA

The New Order.exe file in the TT COPY.zip attachment has a file size of 424,448 bytes. The MD5 checksum is the following string: 0xF09CFB23B1D56F4E16677DFEF1B9747B

The PaymentCopy.scr file in the Payment Copy.zip attachment has a file size of 421,888 bytes. The MD5 checksum is the following string: 0x74A930F2902DC41B1007D6596D349D49

The HSBC_06192013_389123.exe file in the HSBC_06192013_389123.zip attachment file size is unavailable. The MD5 checksum is also unavailable.

The TT COPY For New Order.scr file in the TT COPY For New Order.zip attachment has a file size of 324,096 bytes. The MD5 checksum is the following string: 0x55B1F83937904525369D4DBD6B2AA341

A 15th variant of the TT Copy.exe file in the RFQ.zip attachment has a file size of 909,303 bytes. The MD5 checksum is the following string: 0x834DCE7AADAFF261E60529DF14924F1D

A 16th variant of the TT Copy.exe file in the TT Copy.zip attachment has a file size of 878,291 bytes. The MD5 checksum is the following string: 0x40E742973F02E4285DA10F0395BD760C

The ok.exe file in the ttok.zip attachment has a file size of 1,361,638 bytes. The MD5 checksum is the following string: 0x33208B894D2FD9DA4150974C88828A70

The lmlm.scr file in the TT copy and new order.zip attachment has a file size of 1,208,351 bytes. The MD5 checksum is the following string: 0xDE85B44854EE240F66E8BD73279B3256

A 17th variant of the TT Copy.exe file in the TT COPY.zip attachment has a file size of 1,100,679 bytes. The MD5 checksum is the following string: 0x1047EDFA4BCB390427C0E05133A84DBD

An 18th variant of the tt copy.exe file in the tt copy.zip attachment has a file size of 2,440,192 bytes. The MD5 checksum is the following string: 0x50CB7BA5BFB262F8F4F53770CC3A4ABD

The Invoice.scr file in the TT swift copy and new order.zip attachment has a file size of 233,984 bytes. The MD5 checksum is the following string: 0xBD75DCBC9B5E7D5D46108F3EFB8B6E0C

A 19th variant of the TT Copy.exe file has a file size of 1,324,948 bytes. The MD5 checksum is the following string: 0xB30B7C5001AC93BFBD640A38DD7EB6DE

The TT Copyy.pdf.scr file in the TT Copyy.zip attachment has a file size of 1,466,778 bytes. The MD5 checksum is the following string: 0xA52FC999A9A18AA9258CE54C99420BD7

The Payment-T T COPY-.exe file in the Payment-T T COPY-.zip attachment has a file size of 246,272 bytes. The MD5 checksum is the following string: 0xC725C7B643472482CF1CF742AF519CFE

The HSBC_Docs_18072013.exe file in the HSBC_Docs_18072013.zip attachment has a file size of 158,720 bytes. The MD5 checksum is the following string: 0xC7E5B822101343C1A4D8A2297A1A7D40

The Invoice_3289981_381.exe file size in the Invoice_3289981_381.zip attachment is unavailable. The MD5 checksum is also unavailable.

The tt payment.scr file in the tt payment.zip attachment has a file size of 614,400 bytes. The MD5 checksum is the following string: 0xA4CCE3EDF564B8904E4D8008CECBDE85

A variant of the tt payment.scr file in the tt payment.zip attachment has a file size of 692,224 bytes. The MD5 checksum is the following string: 0xBEF2B6D07B39A1E5EF4B5BED6AAECC59

The photo.scr file in the Attachments_2013718.zip attachment has a file size of 715,090 bytes. The MD5 checksum is the following string: 0xF2BD3117701075818B7F467CB2EDE647

The TTcopy.exe file in the TTcopy.zip attachment has a file size of 2,074,112 bytes. The MD5 checksum is the following string: 0xDC85BAA4ABD2BB76B1EE3C9DD47FAEB1

A 20th variant of TT COPY.exe file in the TT COPY.zip attachment has a file size of 853,107 bytes. The MD5 checksum is the following string: 0x486AA01E00343614D79CA991DC73BD04

A fourth variant of Swift Copy.exe file in the Swift Copy.zip attachment has a file size of 491,572 bytes. The MD5 checksum is the following string: 0xA6291FB20770579143D03D2B451A8C35

A fifth variant of Swift Copy.exe file in the Swift Copy.zip attachment has a file size of 512,052 bytes. The MD5 checksum is the following string: 0xA32C51DA4BC812B2D51C16C971429A46

The tt-copy.scr file in the tt-copy.zip attachment has a file size of 526,981 bytes. The MD5 checksum is the following string: 0xBEAF3C5C38C2CAC4319B9F62ABB02369

A sixth variant of the Swift Copy.exe file in the Swift Copy.zip attachment has a file size of 512,052 bytes. The MD5 checksum is the following string: 0x4742663D44A417CA0329787EBB26C4E2

The DONE.exe file in the TT payment.zip attachment has a file size of 247,713 bytes. The MD5 checksum is the following string: 0x5208EAA4F0BD1698586A5858978D7091

The SwiftCopyReceipt20082013.scr file in the SwiftCopyReceipt20082013.zip attachment has a file size of 206,848 bytes. The MD5 checksum is the following string: 0x6380AB1187A51EEF8D31964B3FAFC017

The TT slip.exe file in the TT slip.zip attachment has a file size of 338,133 bytes. The MD5 checksum is the following string: 0x0795B6304DB8B83B77D4F02E098EA228

A variant of the PaymentCopy.scr file in the PaymentCopy.zip attachment has a file size of 293,903 bytes. The MD5 checksum is the following string: 0xA06142E89EF0AF2DDB87CE1ED5B645F0

The Order.exe file in the payment slip.zip attachment has a file size of 880,640 bytes. The MD5 checksum is the following string: 0x09E2DF445B239D8029A21CECD4622DA6

The TT Copy.exe file has a file size of 859,520 bytes. The MD5 checksum is the following string: 0x41D1936CAFB942DE9D987B8A0A2D3F2C

The USD 56,090.exe file in the USD 56,090.zip attachment has a file size of 403,669 bytes. The MD5 checksum is the following string: 0x83100305E9C4A42DB51C5AD5B3E52919

An eighth variant of TT copy.scr file in the TT copy.zip attachment has a file size of 1,527,296 bytes. The MD5 checksum is the following string: 0xE81A1B3E9B0356629C99485E360AD8F5

The SWIFT TT.exe file in the SWIFT TT.zip attachment has a file size of 513,792 bytes. The MD5 checksum is the following string: 0x7DAB1E4FE14540225C9BA9BF06BC8858

The following text is a sample of the email message that is associated with this threat outbreak:

Message Body:

Dear sir,
We have made the payment of $50,000 to your Bank account, the money should be in your account in 2-3 days time.
On the attached file is a TELEX copy of the transaction for your reference.
Print a copy for your reference and confirmed with us when payment is received.
We await your reply.
Best regards
Reem Alman
Hunelite Trading Company

Or

Subject: RE: PAYMENT SWIFT COPY..

Message Body:

Attention: The Executive Director,
This is sequel to our previous mail dated 13-09-2012.
I am mailing to let you know that we made payment of 41,850 U$Dollars through our bank today. Find as attachment the Payment Slip and invoice copy also reconfirm your Account Details in the slip and invoice in other for us to carry on with the next payment steps.
Upon confirmation of the payment, Please proceed to process the order as discussed and send us a copy of the BL . Also let us know the expected time for the delivery in our sea port.
Thank you.
Best regards
Chi lee

Or

Subject: CP Reported as Junk

Message Body:

Many thanks
I've processed the invoice for the freight charges with payment details attached.

Thanks & best regards
Joanne

Joanne McCulloch
Purchasing Manager
direct dial 00 44 141 312 7892
switchboard 00 44 141 213 2435
Cisco Unified 00 44 141 415 4592
purch fax 00 44 141 211 2431
V.Ships UK Limited
For and on behalf of Eitzen Chemical (Singapore) Pte Ltd
as Managers and Agents only
cid:437261615@18062009-10D8

Or

Subject: CREDIT ADVICE / RECEIPT

Message Body:

Hello,
Please confirm that the account in the attached zip Performa Invoices is correct, we are about to make payment.
Thanks & Regards,
Tina Zou

Or

Subject: Tt copy

Message Body:

Hi dear,
please find attached the tt copy.
thanks to get back to me asap after reception.
David Green.

Or

Subject: Re: Swift Copy of the advance payment

Message Body:

Hello,Happy New Year,
Find the attached 30% down payment and will send balance after receiving BL.
Please,update about production timing and all as its a re-order.
Best regards,
Janet Cabon
JC Solutions
500 Rising sun circle
Greenwood NY,USA

Or

Subject: International remittance

Message Body:

Dear
This email is to notify you that the following transaction has been made by our client for credit to your account.Please find attachment.
HSBC Bank Building Baniyas Square,
Deira, Dubai.
Tel: + 971 4 2258097 from outside the UAE
Fax: +971 4 227 1784
Know more about us on www.hsbc.ae Connect with us on Facebook at www.facebook.com/hsbcbank
____________________________________________
Disclaimer:
"The information contained herein (including any accompanying documents) is confidential and is intended solely for the addressee(s). If you have erroneously received this message, please immediately delete it and notify the sender. Also, if you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this message or any accompanying document is strictly prohibited and is unlawful. The organization is not responsible for any damage caused by a virus or alteration of the e-mail by a third party or otherwise. The contents of this message may not necessarily represent the views or policies of HSBC bank".

Or

Subject: IRON EXE_Attachment _

Message Body:

Find the attached 30% down payment and will send balance after receiving BL.
Please,update about production timing and all as its a re-order.
Best regards,
Regards,
Janet Cabon
JC Solutions
500 Rising sun circle
Greenwood NY,USA
Email:janet.cabon@solution4u.com
YM: jc_solutions9@ymail.com

Or

Subject: Re: Swift copy of the advance payment

Message Body:

--
Find the attached 30% down payment and will send balance after receiving BL.
Please,update about production timing and all as its a re-order.
Best regards,
Regards,
Greg Alison
Greg Trading Company Ltd
500 Rising sun circle
moonwood CA,USA
Email:greg.alison@gregtradingcompany.us
YM: greg.alison@hotmail.com

Or

Subject: payment Bank copy

Message Body:

Dear sir,
please find attached TT payment made to your account today for
balance payment confirm receipt
regards,
Ahmed nasri
Al ansari exchange
add: Al Ansari Business Center, Level 7
P.O.Box 6176, PAKISTAN.
Tel: +971 600 54 6000
www.alansariexchange.com

Or

Subject: Re: Frieght Charges...

Message Body:

Many thanks
I’ve processed the invoice for the freight charges with payment details attached.
Kindly inform us when goods will be shipped and also send copies of B/L and original invoice for our confirmation.
Thanks & best regards
Joanne
Joanne McCulloch
Purchasing Manager
direct dial 00 44 141 312 7892
switchboard 00 44 141 213 2435
Cisco Unified 00 44 141 415 4592
purch fax 00 44 141 211 2431
V.Ships UK Limited
For and on behalf of Eitzen Chemical (Singapore) Pte Ltd
as Managers and Agents only
cid: 437261615@18062009-10D8

Or

Subject: PAYMENT TT COPY

Message Body:

Dear Sir Good day to you! Attached please find the T/T slip for your further reference. Payment remitted for : 1. INV– USD 13,708.80 2. INV– USD 13,708.80 3. INV – USD 13,200.96 Total amount : USD 40,618.56 Please find attached bank swift copy of payment made to your account this morning as you have instructed, please confirm and arrange for shipment soon. waiting to hear from you. Thank you. Wong, Wai Sun (Ms) Purchasing Manager No. 46, Jalan Kapar 27/89, Seksyen 27, 40400 Shah Alam, Selangor Darul Ehsan, Malaysia. Tel : 603-339092 1602 Fax : 603-533318 1650

Or

Subject: Re: Payment/new order update

Message Body:

----
Dear Sir
Here attached is the T/T copy of balance payment
Kindly check and also update us about the new order delivery time.
Purchasing Manager
Ceeyek Group Ltd

Or

Subject: FW:ORDER

Or

Subject: Payment Confirmation !!!

Message Body:

I Attached a copy of bank payment details made yesterday to bank,
please review bank confirmation details and please procedure with
shipment document.
I await your prompt response.
Best Regards,
Laura Fu
Accounts Payable

Or

Subject: FW: TT SLIP FROM ICBC BANK

Message Body:

Dear Sir,
Pls find Attached TT remittance which has been made by our customer for credit to your Bank Account. Ref no:- 6242XFC00558214.
pls confirm the Attached Account details which funds has been credited and rates if any and Also
contact your Bank for confirmation.
Message Details
MT202 Messages
Currency USD
Deal Amount 37897
Transaction Reference Number 7956600118JS
BANK SWIFT
ICBKHKHH
Nostro CHASUS33CXXX
Related Reference 6242XFC00558214
Ordering Institution DUIBAEADLCS
Sender's Correspondent
Receiver's Correspondent
Account Details
Beneficiary Institution ICBC
Sender to Receiver Information
Intermediary BIC
--
Industrial & Commercial Bank of China, Hong Kong Branch
Address: 33/F, ICBC Tower,3 Garden Road, Central, Hong Kong
Hilda Chow
E-mail: hilda.chow@icbcasia.com
Tel: +852-25881188
Fax: +852-28787784
SWIFT: ICBKHKHH
"Print this mail only if absolutely necessary. Save Paper. Save Trees."
"This e-mail message may contain confidential, proprietary or legally privileged information. It should not be used by anyone who is not the original intended recipient. If you have erroneously received this message, please delete it immediately and notify the sender. The recipient acknowledges that ICICI Bank or its subsidiaries and associated companies, (collectively "ICICI Group"), are unable to exercise control or ensure or guarantee the integrity of/over the contents of the information contained in e-mail transmissions and further acknowledges that any views expressed in this message are those of the individual sender and no binding nature of the message shall be implied or assumed unless the sender does so expressly with due authority of ICICI Group. Before opening any attachments please check them for viruses and defects."
2338 × 465 - dubaiexpo.in

Or

Message Body:

Dear Sir,
With instruction from your customer,please find attached to my email copy of our remittance made to your bank and contact your bank immediately to confirm our payment.
Thanks for your understanding,
Regards,
Mohammed Al-Fadhi,
Al Ansari Business Center, Level 7
P.O.Box 6176, Dubai, UAE.
Call Centre: +971 600 54 6000
Headoffice: +971 4 377 2777
Fax no.: +971 4 354 9592
Email: info@alansari.ae
Website: www.alansariexchange.com

Or

Subject: Please respond - overdue payment

Message Body:

Please find attached your invoices for the past months. Remit the payment by 07/18/2013 as outlines under our "Payment Terms" agreement.
Thank you for your business,
Sincerely,
Lydia Woods
This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
The information contained in this message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify your representative immediately and delete this message from your computer. Thank you.

Or

Subject: Swift copy

Message Body:

Hello Dear
Your customer instructed us to transfer the balance payment to your account and e mail you the swift copy and also a copy to his own e mail, we are sorry for the delay in the balance payment, we have transferred the balance to your account, attached is the swift copy of the balance payment
.
Regards Mr Peter Bin
Economic Exchange Centre. 116/356 naif road,deirai,
U.A.E Po Box:116496
Tel: +971 4 2717475
Fax: +971 4 2725838

Or

Subject: PI Order Payment 2082013

Message Body:

Dear Sir,
Please see attachment for swift copy of part payment from Al manahiji trading Est.
$85,200 The 70% balance payment will be made early next week.
Please revert back to us by confirming the arrival of this payment.
Hassan Shalaby
Al manahiji trading Est. RO
SCC Services Romania, Niciman Street,
2 700521 Iasi, Jud. Iasi Romania

Or

Subject: Fwd: Shaun ParkLee payment slip

Message Body:


Gilles Poitras gpoitras@ggu.edu
Access Services Librarian
Golden Gate University Library
>>> "SM Investments" 8/27/2013 09:24 AM >>>
Your customer instructed us to transfer the balance payment and email
to you the swift copy and a copy to his own email, we are sorry for the
delay of the balance payment, we have transferred the balance to your
account, attached is the swift copy of the balance payment.
Regards Mr Shaun ParkLee
Economic Exchange Centre.
116/356 naif road,deirai, U.A.E
Po Box:116496
Tel: +971 4 2717575
Fax: +971 4 2723838

Or
Subject: Find Attached Copy of the TT slip

Message Body:


> Dear Sir
>
> Find attached transfer Payment slip copy.
>
> We have finally wired the deposit payment to your account today.
>
> Please confirm from your bank and start working on the delivery of our items ASAP.
>
> Accounts Department.
>
> Best regards,
>
> Ahmed Abdulrahman
> Chief Acct
> AL SAHOO TRADING CO WLL.

Or
Subject: 10 messages. 9/9/2013 12:04:28 PM

Cisco Security analysts examine real-world email traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global email security threats and trends. Cisco will continue to monitor this threat and automatically adapt systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.

Cisco security appliances protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Email that is managed by Cisco and end users who are protected by Cisco Web Security Appliances will not be impacted by these attacks. Cisco security appliances are automatically updated to prevent both spam email and hostile web URLs from being passed to the end user.

Related Links
Cisco Security
Cisco SenderBase Security Network
 
Alert History
 

Version 77, September 12, 2013, 11:23 AM: Cisco Security has detected significant activity on September 11, 2013.

Version 76, September 9, 2013, 9:29 PM: Cisco Security has detected significant activity on September 9, 2013.

Version 75, September 5, 2013, 6:51 PM: Cisco Security has detected significant activity on September 5, 2013.

Version 74, September 4, 2013, 12:57 PM: Cisco Security has detected significant activity on September 3, 2013.

Version 73, August 28, 2013, 12:07 PM: Cisco Security has detected significant activity on August 27, 2013.

Version 72, August 27, 2013, 7:09 PM: Cisco Security has detected significant activity on August 27, 2013.

Version 71, August 22, 2013, 3:40 PM: Cisco Security has detected significant activity on August 22, 2013.

Version 70, August 21, 2013, 1:54 PM: Cisco Security has detected significant activity on August 21, 2013.

Version 69, August 12, 2013, 7:48 PM: Cisco Security has detected significant activity on August 12, 2013.

Version 68, August 12, 2013, 11:24 AM: Cisco Security has detected significant activity on August 11, 2013.

Version 67, August 6, 2013, 5:31 PM: Cisco Security has detected significant activity on August 5, 2013.

Version 66, August 5, 2013, 11:46 AM: Cisco Security has detected significant activity on August 3, 2013.

Version 65, July 22, 2013, 3:44 PM: Cisco Security has detected significant activity on July 20, 2013.

Version 64, July 19, 2013, 1:14 PM: Cisco Security has detected significant activity on July 18, 2013.

Version 63, July 19, 2013, 12:13 PM: Cisco Security has detected significant activity on July 18, 2013.

Version 62, July 18, 2013, 2:36 PM: Cisco Security has detected significant activity on July 17, 2013.

Version 61, July 16, 2013, 8:05 PM: Cisco Security has detected significant activity on July 16, 2013.

Version 60, July 15, 2013, 11:50 AM: Cisco Security has detected significant activity on July 12, 2013.

Version 59, July 12, 2013, 4:01 PM: Cisco Security has detected significant activity on July 11, 2013.

Version 58, July 11, 2013, 1:13 PM: Cisco Security has detected significant activity on July 10, 2013.

Version 57, July 10, 2013, 2:02 PM: Cisco Security has detected significant activity on July 9, 2013.

Version 56, June 26, 2013, 1:30 PM: Cisco Security has detected significant activity on June 26, 2013.

Version 55, June 24, 2013, 4:00 PM: Cisco Security has detected significant activity on June 21, 2013.

Version 54, June 20, 2013, 3:16 PM: Cisco Security has detected significant activity on June 20, 2013.

Version 53, June 19, 2013, 3:47 PM: Cisco Security has detected significant activity on June 18, 2013.

Version 52, June 17, 2013, 1:59 PM: Cisco Security has detected significant activity on June 16, 2013.

Version 51, June 13, 2013, 3:09 PM: Cisco Security has detected significant activity on June 12, 2013.

Version 50, June 12, 2013, 1:45 PM: Cisco Security has detected significant activity on June 11, 2013.

Version 49, June 6, 2013, 2:47 PM: Cisco Security has detected significant activity on June 5, 2013.

Version 48, May 28, 2013, 2:43 PM: Cisco Security has detected significant activity on May 24, 2013.

Version 47, May 24, 2013, 7:38 PM: Cisco Security has detected significant activity on May 23, 2013.

Version 46, May 22, 2013, 3:23 PM: Cisco Security has detected significant activity on May 21, 2013.

Version 45, May 21, 2013, 8:07 PM: Cisco Security has detected significant activity on May 20, 2013.

Version 44, May 20, 2013, 2:30 PM: Cisco Security has detected significant activity on May 19, 2013.

Version 43, May 17, 2013, 2:18 PM: Cisco Security has detected significant activity on May 17, 2013.

Version 42, May 16, 2013, 4:25 PM: Cisco Security has detected significant activity on May 16, 2013.

Version 41, May 16, 2013, 2:39 PM: Cisco Security has detected significant activity on May 16, 2013.

Version 40, May 13, 2013, 9:00 PM: Cisco Security has detected significant activity on May 12, 2013.

Version 39, May 9, 2013, 3:17 PM: Cisco Security has detected significant activity on May 8, 2013.

Version 38, May 6, 2013, 7:28 PM: Cisco Security has detected significant activity on May 6, 2013.

Version 37, May 3, 2013, 5:56 PM: Cisco Security has detected significant activity on May 3, 2013.

Version 36, May 3, 2013, 12:48 PM: Cisco Security has detected significant activity on May 2, 2013.

Version 35, April 29, 2013, 8:55 PM: Cisco Security has detected significant activity on April 29, 2013.

Version 34, April 26, 2013, 1:54 PM: Cisco Security has detected significant activity on April 26, 2013.

Version 33, April 25, 2013, 3:40 PM: Cisco Security has detected significant activity on April 25, 2013.

Version 32, April 22, 2013, 8:47 PM: Cisco Security has detected significant activity on April 22, 2013.

Version 31, April 15, 2013, 8:53 PM: Cisco Security has detected significant activity on April 15, 2013.

Version 30, April 4, 2013, 2:58 PM: Cisco Security has detected significant activity on April 4, 2013.

Version 29, April 3, 2013, 5:41 PM: Cisco Security has detected significant activity on April 3, 2013.

Version 28, March 28, 2013, 1:24 PM: Cisco Security has detected significant activity on March 27, 2013.

Version 27, March 14, 2013, 6:31 AM: Cisco Security has detected significant activity on March 14, 2013.

Version 26, March 11, 2013, 7:52 AM: Cisco Security has detected significant activity on March 11, 2013.

Version 25, March 6, 2013, 7:11 AM: Cisco Security has detected significant activity on March 5, 2013.

Version 24, March 5, 2013, 7:06 AM: Cisco Security has detected significant activity on March 4, 2013.

Version 23, February 25, 2013, 6:54 AM: Cisco Security has detected significant activity on February 25, 2013.

Version 22, February 22, 2013, 6:51 AM: Cisco Security has detected significant activity on February 21, 2013.

Version 21, February 18, 2013, 6:12 AM: Cisco Security has detected significant activity on February 18, 2013.

Version 20, February 7, 2013, 6:03 AM: Cisco Security has detected significant activity on February 7, 2013.

Version 19, February 5, 2013, 6:08 AM: Cisco Security has detected significant activity on February 4, 2013.

Version 18, February 4, 2013, 7:16 AM: Cisco Security has detected significant activity on February 1, 2013.

Version 17, January 25, 2013, 10:30 AM: Cisco Security has detected significant activity on January 25, 2013.

Version 16, January 25, 2013, 6:59 AM: Cisco Security has detected significant activity on January 25, 2013.

Version 15, January 17, 2013, 6:13 AM: Cisco Security has detected significant activity on January 16, 2013.

Version 14, January 15, 2013, 6:49 AM: Cisco Security has detected significant activity on January 14, 2013.

Version 13, January 11, 2013, 7:03 AM: Cisco Security has detected significant activity on January 11, 2013.

Version 12, January 9, 2013, 6:50 AM: Cisco Security has detected significant activity on January 9, 2013.

Version 11, January 8, 2013, 7:38 AM: Cisco Security has detected significant activity on January 8, 2013.

Version 10, January 2, 2013, 7:20 AM: Cisco Security has detected significant activity on December 27, 2012.

Version 9, December 17, 2012, 7:23 AM: Cisco Security has detected significant activity on December 14, 2012.

Version 8, December 6, 2012, 8:45 AM: Cisco Security has detected significant activity on December 5, 2012.

Version 7, November 26, 2012, 3:12 PM: Cisco Security has detected significant activity on November 23, 2012.

Version 6, November 26, 2012, 10:29 AM: Cisco Security has detected significant activity on November 21, 2012.

Version 5, November 20, 2012, 11:22 AM: Cisco Security has detected significant activity on November 19, 2012.

Version 4, October 26, 2012, 11:10 AM: Cisco Security has detected significant activity on October 25, 2012.

Version 3, September 13, 2012, 3:40 PM: Cisco Security has detected a significant activity on September 13, 2012.

Version 2, August 27, 2012, 12:42 PM: Cisco Security has detected a significant activity on August 26, 2012.

Version 1, August 20, 2012, 3:55 PM: Cisco Security has detected a significant activity on August 19, 2012.


Product Sets
 
The security vulnerability applies to the following combinations of products.

Primary Products:
IntelliShieldThreat Outbreak Alert Original Release Base

Associated Products:
N/A




Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service. This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment.


LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
Powered by  IntelliShield