AppRiver Malware Watch

X.Var.Kazy.1018

noreply@blogger.com (Troy Gill) — Wed, 19 Oct 2011 12:55:00 +0000

Subject:Track your parcel No565810

Attachment: Post_Label_N0#75347

AVs: Bit, Comm, F-P, F-S, GD, K7, nP,So 8/42 (19.0%)

Body:

Dear customer.
Your package has been sent to your address.
Please find a post label attached which contains a track number of your package.
You can find out an exact date of the delivery with the help of the track number.
Thank you.
DHL Customer.

X.Troj/FakeAV-ENL.ac

noreply@blogger.com (Troy Gill) — Thu, 15 Sep 2011 14:12:00 +0000

Subject: ACH Payment 53036341 Failed

Attachment: report_1509.pdf.zip

AV: 13/44 (29.5%)

Body:

The ACH transaction (ID: 95216329), recently sent from your bank account (by you or any other person), was rejected by the Electronic Payments Association.
###############################################
Canceled transaction
Transaction ID: 95216329
Reason of rejection See details in the report below
Transaction Report report_1509.pdf.zip (ZIP archive, Adobe PDF)
###############################################
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

2011 NACHA - The Electronic Payments Association

X.Mal/BredoZp-B_1

noreply@blogger.com (Troy Gill) — Wed, 27 Jul 2011 13:24:00 +0000

Subject: Hotel The ST. Regis Monarch Beach made wrong transaction(hotel name varys)

Attachment: RefundForm129.zip (45K)

AVs: 3/43 (7%) So, TrM, TrM(HC)

X.W32.Bredolab.apr1

noreply@blogger.com (...phread) — Fri, 01 Apr 2011 13:41:00 +0000

Subject: Post Express Branch. Get the parcel NR 79792 (random number)
Attachment: Invoice_Copy_IN585.zip
AVs: 5/41 (12.2%)

Body:

Good afternoon. Post notification. No.58479 The company could not deliver your package to your address. Your package has been returned to the Post Express office. The reason of the return is "Error in the delivery address" Please attention! Attached to the letter mailing label contains the details of the package delivery. Please print out the invoice copy attached and collect the package at our office Thank you for attention. Post Express.

X.W32.trojo.htm.a

noreply@blogger.com (Troy Gill) — Thu, 10 Mar 2011 16:09:00 +0000

Subject: Dear Grow Financial customer,
Attachment: GrowFinancialFCU_Account_Restore_Form.pdf.zip
AVs: 0/43

Body:

We recently reviewed your account, and we are suspecting that your Grow Financial Internet Banking account may have been accessed from an unauthorized computer..

This may be due to changes in your IP address or location. Protecting the security of your account and of the Grow Financial Bank network is our primary concern.

We are asking you to immediately login and report any unauthorized withdrawals, and check your account profile to make sure no changes have been made.

To protect your account please follow the instructions below:

* DO NOT SHARE YOUR PASSWORD WITH OTHER USERS

* LOG OFF AFTER USING YOUR ONLINE ACCOUNT

We attached to this email a confirmation form to update your details, please download and extract it .

Submitting this form you will restore your Grow Financial account. NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer, Firefox ,Netscape)

We apologize for any inconvenience this may cause, and appreciate your support in helping us maintaining the integrity of the entire Grow Financial Bank system.

Thank you.

X.W32.zbot.packed.gen.y

noreply@blogger.com (Troy Gill) — Tue, 01 Mar 2011 17:28:00 +0000

Subject: UPS Delivery NoticeID1645651

Attachment: ups-prt-copy-Invoice-3710398-74119628.zip (137 KB)

AVs: 3/ 42 (7.1%) Dr, Mc, So

Body:

ï»¿ Hello!
Unfortunately we failed to deliver the postal package you have sent in time because the recipient's address is erroneous.
Please print out the shipment label attached and collect the package at our office.
Thank you,
UPS Express Brown's dedication to service began when he personally experienced the impact and importance of the Ronald McDonald House(RMH). Brown's son, Dallas, was born with sever

X.W32.PX.pakc

noreply@blogger.com (...phread) — Fri, 18 Feb 2011 16:17:00 +0000

Subject: Post Express! Package is available for pickup! NR8907456 (random number)
Post Express! Get the parcel NR5459323 (random number)
Post Express Service! Error in the delivery address! NR5269 (random number)
Attachment: Post_Express_Label_SN.59075.zip
Post_Express_Label_RES.0677.zip
Post_Express_Label_IVN83867.zip

Body:

Good afternoon

Email notification ID 64354510

Your package has been returned to the Post Express office.

The reason of the return is "Incorrect delivery address of the package"

Important message!
Attached to the letter mailing label contains the details of the package delivery.
You have to print mailing label, and come in the Post Express office in order to receive the packages.

Thank you for using our services.
Post Express Support

X.W32.downloader.gen2

noreply@blogger.com (Troy Gill) — Thu, 20 Jan 2011 14:37:00 +0000

Subject: happy day!
Attachment: happyday.zip

Body:

hope u like ~~~LOL

X.W32.dhl.12.20

noreply@blogger.com (...phread) — Mon, 20 Dec 2010 14:54:00 +0000

Subject: ">DHL International Services
Attachment: SNPcopy_122010.zip

Body:

Dear Sir/Madam,

Your package has been returned to the DHL office. The reason of the return is - Error in the delivery address

Attached to the letter mailing label contains the details of the package delivery. You have to print mailing label, and come in the office in order to receive the packages.

Thank you for attention.

DHL

X.Paypal.actx.a

noreply@blogger.com (Troy Gill) — Wed, 08 Dec 2010 17:05:00 +0000

Subject: Your Account Has Been Limited !
Attachment: PayPal.com_Account_Confirmation_Form.pdf.zip
AVs: 0/43 0%

X.W32.Zbot12.1.pak

noreply@blogger.com (...phread) — Wed, 01 Dec 2010 21:23:00 +0000

Subject: DHL Delivery Services, DHL Parcel Message, DHL Notification Message
Attachment: 238000.zip, 681229.zip, 56037.zip, 981677.zip ...
Body:

Dear Customer!

We were not able to deliver your package to your address!
Please pick up your package in local DHL office.

Attention!
The post label is attached to this e-mail.
We kindly ask you to print it and take it to the post office to pick up the package.
Thank you!

DHL EXPRESS - good for business

X.W32.Zbot.deu

noreply@blogger.com (...phread) — Thu, 28 Oct 2010 14:43:00 +0000

Subject: Ich weiß nicht, wie ich es sagen, aber ich habe vor langer
Attachment: Bild.zip

Body:

Hallo Man, Ich weiЯ nicht, wie ich es sagen, aber ich habe vor langer Zeit zu euch senden einige Fotos tryed, aber ich habe gedacht, dass Sie nicht interessiert sind, mich zu sehen. Aber jetzt werde ich Ihnen die Fotos in der Anlage. Laden Sie die Bilder und extrahieren sie, ich bin sicher, dass Sie sie mцgen. Das Passwort ist: 123456 Machen Sie einen schцnen Tag.

X.W32.kryptik.hpqb

noreply@blogger.com (Troy Gill) — Tue, 26 Oct 2010 14:05:00 +0000

Subject: UPS Invoice copy N47204
Attachment: UPS_document_ID38967.zip
AVs: (18.2% detection rate)

Body:
(see image)

X.W32.Oficla-A1020

noreply@blogger.com (...phread) — Wed, 20 Oct 2010 18:49:00 +0000

Subject: Your package is available for pickup.ID25391 (random number)
Attachment: UPS_Label_NR7753.zip

Body:

Hello

Your parcel has arrived at the post office on October 18.
Our Driver was unable to deliver the parcel to your address.
To receive a parcel you must go to the nearest UPS office and show your mailing label.
You need to print mailing label, and show it in UPS office to receive the parcel.

Thank you for your attention.
UPS Global Services.

X.W32/Bredolab.2a

noreply@blogger.com (Troy Gill) — Thu, 14 Oct 2010 13:20:00 +0000

Subject: UPS Online Service. Error delivery address number 7114
Attachment: dode.jpg
AVs:10 /43 (23.3%) Au, Cat, Cl, eS, F-P, Jia, K7, PcT, So, TheH

Body:

Dear client
Your parcel has arrived at the post office on October 12. Our Driver was unable to deliver the parcel to your address.To receive a parcel you must go to the nearest UPS office and show your mailing label.Mailing label is attached to this letter.

You need to print mailing label, and show it in UPS office to receive the parcel.

Thank you for your attention.

UPS Global Services.

X.Win32/Oficla.T1

noreply@blogger.com (Troy Gill) — Mon, 04 Oct 2010 13:53:00 +0000

Subject:USPS Delivery Problem NR5170282
Attachmant: USPSLabel.zip
AV's: 2/ 43 (4.7%)

Body:
*Uses image as shown above

X.W32.Kryptik.928

noreply@blogger.com (...phread) — Tue, 28 Sep 2010 16:43:00 +0000

Subject: Approved meeting minues
Attachment: Approved.zip

body:

Good Morning Everyone, Here are the approved September 28, 2010 meeting minutes.

X.Win32.Oficla-AB.uld

noreply@blogger.com (Troy Gill) — Fri, 24 Sep 2010 13:12:00 +0000

Subject: USPS Delivery Problem NR368058
Attachment: USPSLabelDoc.zip (23 KB)
AVs: Result: 5/ 42 (11.9%) CL, GD, NOD, PA, PR

Message Body (uses a .jpg instead of text)

X.Html.JS.915

noreply@blogger.com (...phread) — Wed, 15 Sep 2010 16:44:00 +0000

Subject: Labels and such
Attachment: label.html

Body:

Labels and such Hey complet

Payment has been made and attached are the labels.
Thanks a ton man, very cool!
Can't wait to get em.

Laura

----------------------------------------------------------------------

Your payment for $375.00 USD to complet@talb.com has been sent.

It may take a few moments for this transaction to appear in the Recent Activity list on your Account Overview.

Payment details
Amount: $375.00 USD
Transaction Date: Sep 15, 2010
Transaction ID: 8U7617815K399153U

Subject: You've got money!

X.Win32/Oficla.IE

noreply@blogger.com (Troy Gill) — Wed, 01 Sep 2010 13:16:00 +0000

Subject: DHL Services. Get your parcel number 3948
Attachment: di cosol.jpg (23 KB)

AVs: 15/ 43 (34.9%)

Body:

Dear customer.
We were not able to deliver your package to your address.

Reason: Error in delivery address.

Attention!

Get your parcel in your local post office.The postal label is attached to this e-mail.We kindly ask you to print it and take it to the post office to pick up the package.

Thank you!

DHL International GmbH.

X.Mal/FakeAV-BW.1.1

noreply@blogger.com (...phread) — Mon, 23 Aug 2010 21:51:00 +0000

Subject: Fedex Invoice copy N9956225 (random number)
Attachment: FEDEXInvoiceEE744573OP.zip

Body:
[image]

X.JS.Redirect.CV

noreply@blogger.com (...phread) — Thu, 19 Aug 2010 16:03:00 +0000

Subject: Resume
Attachment: CV.html

Body:

please find attached my cv

X.W32.Kryptik.GDT

noreply@blogger.com (...phread) — Thu, 19 Aug 2010 16:01:00 +0000

Subject: Rejected ACH transaction, please review the transaction report
Attachment: ACH_0889388_REP.zip

body:

Dear bank account holder, The ACH transaction, recently initiated from your bank account (by you or any other person), was rejected by the Electronic Payments Association. Please Find Attached Transaction Report ------------------------------------------------------------------ Electronic Payments Association Manager

X.W32.zbot.FH

noreply@blogger.com (...phread) — Tue, 17 Aug 2010 14:13:00 +0000

Subject: Good Music
Attachment: Second chord sounds in world's longest lasting concert - Yahoo! News.zip

Body:

It has a beat, you can dance to it – I’d give it an eight.

************************************************************************
This e-mail and any of its attachments may contain Exelon Corporation
proprietary information, which is privileged, confidential, or subject
to copyright belonging to the Exelon Corporation family of Companies.
This e-mail is intended solely for the use of the individual or entity
to which it is addressed. If you are not the intended recipient of this
e-mail, you are hereby notified that any dissemination, distribution,
copying, or action taken in relation to the contents of and attachments
to this e-mail is strictly prohibited and may be unlawful. If you have
received this e-mail in error, please notify the sender immediately and
permanently delete the original and any copy of this e-mail and any
printout. Thank You.
************************************************************************

X.Zbotb.0817ndg

noreply@blogger.com (...phread) — Tue, 17 Aug 2010 13:34:00 +0000

Subject: Tracking # and Invoice
Attachment: attach.zip

Body:

CIRCUIT SPECIALISTS, INC. TRACK Date-Tue, 17 Aug 2010 22:19:02 +0900 Ref# TRACK Time-15:35:42 Page 1 Ship Date Tue, 17 Aug 2010 22:19:02 +0900 THRU Tue, 17 Aug 2010 22:19:02 +0900 The attached file is a copy of your invoice. It is best viewed with notepad or some other text viewer that does not try to format the text. Date Shipped Our Ref. Your Ref. Tracking # Tue, 17 Aug 2010 22:19:02 +0900 255596 NET 52777 1Z8771870342348672