AppRiver Malware Watch

X.W32.Rapid.RogueAV.124

noreply@blogger.com (Troy Gill) — Wed, 20 Feb 2013 18:55:00 +0000

You have received a secure message

Read your secure message by opening the attachment, secure_mail_QYNYS22W. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it in a Web browser. To access from a mobile device, forward this message to mobile@res.ff-inc.com to receive a mobile login URL.

If you have concerns about the validity of this message, please contact the sender directly. For questions about secure e-mail encryption service, please contact technical support at 888.259.7945.

2000-2013 First Foundation Inc. All rights reserved.

X.w32.kryptic.spmcp

noreply@blogger.com (Troy Gill) — Thu, 19 Jul 2012 14:44:00 +0000

AVs: 2/42 (4.7%) CAT, Fort
Subject:SpamCop: Email Account Alert #2940384948
Attachment: SpapCop_Email_Account_Alert_083994906.zip(36 kb)

Body:
Hello,
Your email account could be blacklisted due to fraudulent activity.

Please refer to attached file for full details of this issue.

Thanks, SpamCop.net
(c) 1992-2012 Cisco Systems, Inc. All rights reserved.

X.Troj.drop.BoA.scu

noreply@blogger.com (Troy Gill) — Mon, 09 Apr 2012 12:57:00 +0000

Subject: Your Bank of America Account Status, Mon, 9 Apr 2012

Attachment: BankofAmerica-SecurityNotification-SecurityUpdate-Apr2012-684284205.zip (100 KB)

AVs: 0 / 42 (not currently recognized by any AV engines)

Body:

Hello Dear!
We have received too many reports from our customers about fraudulent online and
ATM transactions. We have launched a new security system to secure new and old
accounts from this kind of fraud. To prevent your checking or savings account from
this fraud, update your information on the attached file which you should download
and open.

Thank You
Bank of America Security Team
Mon, 9 Apr 2012 14:55:34 +0200 N4R3JNE51YRH09LGB29P

X.Win32.trjndwnldr.Dofoil.O

noreply@blogger.com (Troy Gill) — Wed, 29 Feb 2012 16:57:00 +0000

Subject:Your order has been completed

Attachement: Ticket.zip (41KB)

AVs: 13/43

Body:

Hello
FLIGHT NUMBER AA986
ELECTRONIC 1568470
DATE & TIME / MARCH 04, 2012, 09:25 AM
ARRIVING / Aurora
TOTAL PRICE / 345.11 USD
Please find your ticket attached.
You can print your ticket.
Thank you
American Airlines.

X.Win32.Buzus.AK

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 21:13:00 +0000

Subject: You have got a new message on Facebook!
Attachment: Facebook Message.zip (228kb)

Body:

facebook
Hi,You have got a personal message on Facebook from your friend.To read it please check the attachment.

Thanks, The Facebook Team

X.Win32.Netsky.Cz

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:59:00 +0000

Subject: Thank you from Google!

Attachment:CV-20100120-112.zip (378KB)

AVs: 34/43

Body:

We just received your resume and would like to thank you for your interest in working at Google. This email confirms that your application has been submitted for an open position. Our staffing team will carefully assess your qualifications for the role(s) you selected and others that may be a fit. Should there be a suitable match, we will be sure to get in touch with you. Click on the attached file to review your submitted application. Have fun and thanks again for applying to Google! Google Staffing

X.Win32/Merond.O worm

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:51:00 +0000

Subject: Cindy would like to be your friend on hi5!

Attachment: Invitation Card.zip

AVs: 34 / 43 79%

Body:

Join

Log in

Help

Balance: 0 Coins

mobile alerts

Click to Select Language

hi5 Home

Home

My Profile

Friends

Photos

Messages

Games

Groups

Applications

No applications installed

Add Applications…

165 Search true true true false

advanced

Titlebody

Yes

Meet new people and keep up with friends on hi5.

Cindy would like to be your friend on hi5!

I set up a hi5 profile and I want to add you as a friend so we can share pictures and starjt building our network. First see your invitation card I attached!

Once you join, you will have a chance to create a profile, share pictures, and find friends.

X.UPX.App.pakuber

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:43:00 +0000

Subject: Facebook. The new password to your account. #9164

Attachment: FaceBook_PASSWORD_#182-14.zip (39 KB)

AVs: 18 / 43 41.8% Ant, Ava, Bit, Cla, Dr, Em, F-S, Fo, GD, IK, Ka, Mc, NOD, So, Sy, TrM, TrM(hc) VIP

Body:

Hello

Because of the measures taken to provide safety to our clients,your password has been changed.

You can find your new password in attached document.

Thank you,

Facebook Team.

X.win32.worm.fp.Netsky

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:38:00 +0000

Subject: Re: Free porn

Attachment: www[dot]freeporn4all.zip (30KB)

AVs: 39 / 43 90%

Body:

My favourite page.

X.w32.Fedex.zip.JRb

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:33:00 +0000

Subject: Track your shipment NO#2069
Attachment: FEDEX_INVOICE_ID-14714.zip (41 KB)
AVs: 2/43 4.6% TrM, TrM(hc)

Body:

FedEx notification,

Your package has been returned to the FedEx office.T
he reason of the return is - Incorrect delivery address of the package.Please print out the invoice copy attached and collect the package at our office.

FedEx Services.

X.W32.Fedex.zip.2JRa

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:26:00 +0000

Subject: Order449850474

Attachment: Ticket_AA_12-434.zip

AVs: 3 / 43 6.9% Fo, TrM, TrM (hc)

Body:

Hello

FLIGHT NUMBER AA288

ELECTRONIC 3766706

DATE & TIME / MARCH 11, 2012, 09:12 PM

ARRIVING / Richmond

TOTAL PRICE / 351.21 USD

Please find your ticket attached.

You can print your ticket.

Thank you

AA customer services.

X.win32.worm.zppr.faa

noreply@blogger.com (Troy Gill) — Mon, 27 Feb 2012 20:15:00 +0000

Subject: Re: Encrypted Mail

Attachment: document.zip (30 KB)

AVs: 13/43 30% Av, AVG, Cla, eS, eT, F-P, Mc, NOD, Nor, So, Ri, TrM ,VB

Body:

Please read the document.

++++ Attachment: No Virus found++++

X.Var.Kazy.1018

noreply@blogger.com (Troy Gill) — Wed, 19 Oct 2011 12:55:00 +0000

Subject:Track your parcel No565810

Attachment: Post_Label_N0#75347

AVs: Bit, Comm, F-P, F-S, GD, K7, nP,So 8/42 (19.0%)

Body:

Dear customer.
Your package has been sent to your address.
Please find a post label attached which contains a track number of your package.
You can find out an exact date of the delivery with the help of the track number.
Thank you.
DHL Customer.

X.Troj/FakeAV-ENL.ac

noreply@blogger.com (Troy Gill) — Thu, 15 Sep 2011 14:12:00 +0000

Subject: ACH Payment 53036341 Failed

Attachment: report_1509.pdf.zip

AV: 13/44 (29.5%)

Body:

The ACH transaction (ID: 95216329), recently sent from your bank account (by you or any other person), was rejected by the Electronic Payments Association.
###############################################
Canceled transaction
Transaction ID: 95216329
Reason of rejection See details in the report below
Transaction Report report_1509.pdf.zip (ZIP archive, Adobe PDF)
###############################################
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

2011 NACHA - The Electronic Payments Association

X.Mal/BredoZp-B_1

noreply@blogger.com (Troy Gill) — Wed, 27 Jul 2011 13:24:00 +0000

Subject: Hotel The ST. Regis Monarch Beach made wrong transaction(hotel name varys)

Attachment: RefundForm129.zip (45K)

AVs: 3/43 (7%) So, TrM, TrM(HC)

X.W32.Bredolab.apr1

noreply@blogger.com (...phread) — Fri, 01 Apr 2011 13:41:00 +0000

Subject: Post Express Branch. Get the parcel NR 79792 (random number)
Attachment: Invoice_Copy_IN585.zip
AVs: 5/41 (12.2%)

Body:

Good afternoon. Post notification. No.58479 The company could not deliver your package to your address. Your package has been returned to the Post Express office. The reason of the return is "Error in the delivery address" Please attention! Attached to the letter mailing label contains the details of the package delivery. Please print out the invoice copy attached and collect the package at our office Thank you for attention. Post Express.

X.W32.trojo.htm.a

noreply@blogger.com (Troy Gill) — Thu, 10 Mar 2011 16:09:00 +0000

Subject: Dear Grow Financial customer,
Attachment: GrowFinancialFCU_Account_Restore_Form.pdf.zip
AVs: 0/43

Body:

We recently reviewed your account, and we are suspecting that your Grow Financial Internet Banking account may have been accessed from an unauthorized computer..

This may be due to changes in your IP address or location. Protecting the security of your account and of the Grow Financial Bank network is our primary concern.

We are asking you to immediately login and report any unauthorized withdrawals, and check your account profile to make sure no changes have been made.

To protect your account please follow the instructions below:

* DO NOT SHARE YOUR PASSWORD WITH OTHER USERS

* LOG OFF AFTER USING YOUR ONLINE ACCOUNT

We attached to this email a confirmation form to update your details, please download and extract it .

Submitting this form you will restore your Grow Financial account. NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer, Firefox ,Netscape)

We apologize for any inconvenience this may cause, and appreciate your support in helping us maintaining the integrity of the entire Grow Financial Bank system.

Thank you.

X.W32.zbot.packed.gen.y

noreply@blogger.com (Troy Gill) — Tue, 01 Mar 2011 17:28:00 +0000

Subject: UPS Delivery NoticeID1645651

Attachment: ups-prt-copy-Invoice-3710398-74119628.zip (137 KB)

AVs: 3/ 42 (7.1%) Dr, Mc, So

Body:

ï»¿ Hello!
Unfortunately we failed to deliver the postal package you have sent in time because the recipient's address is erroneous.
Please print out the shipment label attached and collect the package at our office.
Thank you,
UPS Express Brown's dedication to service began when he personally experienced the impact and importance of the Ronald McDonald House(RMH). Brown's son, Dallas, was born with sever

X.W32.PX.pakc

noreply@blogger.com (...phread) — Fri, 18 Feb 2011 16:17:00 +0000

Subject: Post Express! Package is available for pickup! NR8907456 (random number)
Post Express! Get the parcel NR5459323 (random number)
Post Express Service! Error in the delivery address! NR5269 (random number)
Attachment: Post_Express_Label_SN.59075.zip
Post_Express_Label_RES.0677.zip
Post_Express_Label_IVN83867.zip

Body:

Good afternoon

Email notification ID 64354510

Your package has been returned to the Post Express office.

The reason of the return is "Incorrect delivery address of the package"

Important message!
Attached to the letter mailing label contains the details of the package delivery.
You have to print mailing label, and come in the Post Express office in order to receive the packages.

Thank you for using our services.
Post Express Support

X.W32.downloader.gen2

noreply@blogger.com (Troy Gill) — Thu, 20 Jan 2011 14:37:00 +0000

Subject: happy day!
Attachment: happyday.zip

Body:

hope u like ~~~LOL

X.W32.dhl.12.20

noreply@blogger.com (...phread) — Mon, 20 Dec 2010 14:54:00 +0000

Subject: ">DHL International Services
Attachment: SNPcopy_122010.zip

Body:

Dear Sir/Madam,

Your package has been returned to the DHL office. The reason of the return is - Error in the delivery address

Attached to the letter mailing label contains the details of the package delivery. You have to print mailing label, and come in the office in order to receive the packages.

Thank you for attention.

DHL

X.Paypal.actx.a

noreply@blogger.com (Troy Gill) — Wed, 08 Dec 2010 17:05:00 +0000

Subject: Your Account Has Been Limited !
Attachment: PayPal.com_Account_Confirmation_Form.pdf.zip
AVs: 0/43 0%

X.W32.Zbot12.1.pak

noreply@blogger.com (...phread) — Wed, 01 Dec 2010 21:23:00 +0000

Subject: DHL Delivery Services, DHL Parcel Message, DHL Notification Message
Attachment: 238000.zip, 681229.zip, 56037.zip, 981677.zip ...
Body:

Dear Customer!

We were not able to deliver your package to your address!
Please pick up your package in local DHL office.

Attention!
The post label is attached to this e-mail.
We kindly ask you to print it and take it to the post office to pick up the package.
Thank you!

DHL EXPRESS - good for business

X.W32.Zbot.deu

noreply@blogger.com (...phread) — Thu, 28 Oct 2010 14:43:00 +0000

Subject: Ich weiß nicht, wie ich es sagen, aber ich habe vor langer
Attachment: Bild.zip

Body:

Hallo Man, Ich weiЯ nicht, wie ich es sagen, aber ich habe vor langer Zeit zu euch senden einige Fotos tryed, aber ich habe gedacht, dass Sie nicht interessiert sind, mich zu sehen. Aber jetzt werde ich Ihnen die Fotos in der Anlage. Laden Sie die Bilder und extrahieren sie, ich bin sicher, dass Sie sie mцgen. Das Passwort ist: 123456 Machen Sie einen schцnen Tag.

X.W32.kryptik.hpqb

noreply@blogger.com (Troy Gill) — Tue, 26 Oct 2010 14:05:00 +0000

Subject: UPS Invoice copy N47204
Attachment: UPS_document_ID38967.zip
AVs: (18.2% detection rate)

Body:
(see image)