Anywho, I decided to check it out, low and behold (you know whats coming), we gots ourselves both a worm and a little psychology going on "they'll think they gots friends and install our worm LOLZ!" - alas nope, I'm not that gullible.
The e-mail reads:
Facebook is a social utility that connects you with the people around you.
Facebook notifier
One of your old classmates added you as a friend on Facebook. We need to confirm that you know her in order for you to be friends on Facebook.
To see her picture please check your attachment.
Thanks,
The Facebook Team
Facebook © 2008
The attachment, picture.zip, contains (surprise surprise) a lovely little executable (picture.exe), and whilst my AV detected it as a worm (Worm/Agent.FT), I decided to upload it to VT anyway;
http://www.virustotal.com/analisis/792924e8c83e3f1230a0f8b44a11cddf
30/36 is unusually great - normally detection this high takes several weeks, not a couple days (it was apparently uploaded by someone else a couple days prior to my receiving it).
The entire e-mail + headers is as follows;
Exported by: Outlook Export v0.1.2
From: confirm-r16xa@facebookmail.com
E-mail:confirm-r16xa@facebookmail.com [ 204.15.20.125 - mx01.facebookmail.com ]
Date: 10/09/2008 09:15:07
Subject: An old friend added you as a friend on facebook
**************************************************************************
Links
**************************************************************************
Link: hxxp://www.facebook.com/
Domain: www.facebook.com
IP: 69.63.178.16 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: false
Link: hxxp://www.facebook.com/reset.php
Domain: www.facebook.com
IP: 69.63.178.16 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: false
Link: hxxp://static.ak.fbcdn.net/images/welcome/welcome_3.gif
Domain: static.ak.fbcdn.net
IP: 62.41.85.97 [ Resolution failed ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: false
**************************************************************************
Text Version
**************************************************************************
<http://www.facebook.com/>
Email: Password:Remember me
Forgot Password? <http://www.facebook.com/reset.php>
<http://static.ak.fbcdn.net/images/welcome/welcome_3.gif>
Facebook is a social utility that connects you with the people around you.
Facebook notifier
One of your old classmates added you as a friend on Facebook. We need to confirm that you know her in order for you to be friends on Facebook.
To see her picture please check your attachment.
Thanks,
The Facebook Team
Facebook © 2008
**************************************************************************
HTML Version
**************************************************************************
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2><<A HREF="http://www.facebook.com/">http://www.facebook.com/</A>><BR>
Email: Password:Remember me<BR>
Forgot Password? <<A HREF="http://www.facebook.com/reset.php">http://www.facebook.com/reset.php</A>><BR>
<<A HREF="http://static.ak.fbcdn.net/images/welcome/welcome_3.gif">http://static.ak.fbcdn.net/images/welcome/welcome_3.gif</A>><BR>
Facebook is a social utility that connects you with the people around you.<BR>
<BR>
Facebook notifier<BR>
<BR>
<BR>
<BR>
<BR>
One of your old classmates added you as a friend on Facebook. We need to confirm that you know her in order for you to be friends on Facebook.<BR>
<BR>
To see her picture please check your attachment.<BR>
<BR>
<BR>
Thanks,<BR>
<BR>
The Facebook Team<BR>
<BR>
Facebook © 2008<BR>
</FONT>
</P>
</BODY>
</HTML>
**************************************************************************
Headers
**************************************************************************
Return-Path: <confirm-r16xa@facebookmail.com>
Delivered-To: services@[RMV]
Received: from Postfix filter 42a77884ce2a0a03efc6bb50a6dcdb21 (localhost.localdomain [127.0.0.1])
by smtp-in-123.livemail.co.uk (Postfix) with SMTP id 0B8545DE8AE
for <services@[RMV]>; Wed, 10 Sep 2008 09:18:41 +0100 (BST)
Received: from facebookmail.com (mail.squires.co.za [196.37.170.133])
by smtp-in-123.livemail.co.uk (Postfix) with ESMTP id D206F5DE96E
for <services@[RMV]>; Wed, 10 Sep 2008 09:17:13 +0100 (BST)
From: confirm-r16xa@facebookmail.com
To: services@[RMV]
Subject: An old friend added you as a friend on facebook
Date: Wed, 10 Sep 2008 10:15:07 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0011_BC1902DD.257BF8A1"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <20080910081713.D206F5DE96E@smtp-in-123.livemail.co.uk>
X-Original-To: services@[RMV]
Needless to say, if you receive this - delete it!
Posts
No comments:
Post a Comment