Date: Thu, 31 Jul 2014 12:26:53 +0200 [06:26:53 EDT]The file attached is actually DSC_9426679.zip and not .jpg, containing a malicious executable DSC_8832966.exe with a VirusTotal detection rate of 7/53. The CAMAS report shows that the malware attempts to download an additional component from the following locations:
From: EVERNOTE [firstname.lastname@example.org]
Subject: File has been sent [redacted]
DSC_9426679.jpg attached to the letter
Copyright 2014 Evernote Corporation. All rights reserved
These download locations are the same as yesterday's Amazon spam run. The downloaded file has a VT detection rate of 3/53.
The recommended blocklist is the same as yesterday.