Blog for hpHosts, and whatever else I feel like writing about ....

Friday, 26 September 2008

Amazing books! (HIDDENEXT/Worm.Gen and Troj/Agent-HTC)

There's two problems with these e-mails ..... firstly, I did not write a book, and secondly, even if I had, they're under the mis-conception that I can actually write good books LOL!

Greating and felications Friend,

Your new book has brought a lot of excitement to our editorial staff. It's certainly this year's best in its genre. You seem to never going to quit surprising us. We have made a contract with you and guarantee that the first edition will total at least 10 million copies.

Enclosed is the approved and edited copy of your amazing book. Thank you for this paragon of beauty.

Please get in touch with us at your earliest convenience.

Adios


The attachment (31K) is named approved.zip and contains a file named "approved.doc[MANY_SPACES].exe" and detection for it is rubbish;

http://www.virustotal.com/analisis/c4b44222d1d498c795f220989921693a


The e-mail in all of it's glory;

Subjects thus far:

Amazing Book
Excellent Book

Exported by: Outlook Export v0.1.2


From: Susana Hurley
E-mail:unwhchm@bostoncf.com [ - Invalid IP was passed to me ]
Date: 26/09/2008 16:18:01
Subject: Amazing Book
**************************************************************************
Links
**************************************************************************


**************************************************************************
Text Version
**************************************************************************
Greating and felications Friend,

Your new book has brought a lot of excitement to our editorial staff.
It's certainly this year's best in its genre. You seem to never going to
quit surprising us.
We have made a contract with you and guarantee that the first edition
will total at least 10 million copies.

Enclosed is the approved and edited copy of your amazing book. Thank
you for this paragon of beauty.

Please get in touch with us at your earliest convenience.

Adios


**************************************************************************
HTML Version
**************************************************************************
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->

<P><FONT SIZE=2>Greating and felications Friend,<BR>
<BR>
Your new book has brought a lot of excitement to our editorial staff.<BR>
It's certainly this year's best in its genre. You seem to never going to<BR>
quit surprising us.<BR>
We have made a contract with you and guarantee that the first edition<BR>
will total at least 10 million copies.<BR>
<BR>
Enclosed is the approved and edited copy of your amazing book. Thank<BR>
you for this paragon of beauty.<BR>
<BR>
Please get in touch with us at your earliest convenience.<BR>
<BR>
Adios<BR>
</FONT>
</P>

</BODY>
</HTML>

**************************************************************************
Headers
**************************************************************************
Return-Path: <unwhchm@bostoncf.com>
Delivered-To: services@[RMD]
Received: from Postfix filter 42a77884ce2a0a03efc6bb50a6dcdb21 (localhost.localdomain [127.0.0.1])
by smtp-in-72.livemail.co.uk (Postfix) with SMTP id 4FBE466E6E3
for <services@[RMD]>; Fri, 26 Sep 2008 16:18:03 +0100 (BST)
Received: from [163.153.27.216] (unknown [163.153.27.216])
by smtp-in-72.livemail.co.uk (Postfix) with ESMTP id E685566E6D4
for <burnservices@[RMD]>; Fri, 26 Sep 2008 16:18:01 +0100 (BST)
Received: from [163.153.27.216] by mail.global.frontbridge.com; Fri, 26 Sep 2008 10:18:01 -0500
Date: Fri, 26 Sep 2008 10:18:01 -0500
From: "Susana Hurley" <unwhchm@bostoncf.com>
X-Mailer: The Bat! (v3.71.01) Professional
Reply-To: unwhchm@bostoncf.com
X-Priority: 3 (Normal)
Message-ID: <787369064.27570604130467@bostoncf.com>
To: burnservices@[RMD]
Subject: Amazing Book
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------8401675F8425842C"
X-Original-To: burnservices@[RMD]

No comments: