Sponsored by..

Friday, 27 December 2013

Odd "Wire transfer to your account" spam

Almost all spam tends to be some sort of scam or some sort of malware. I can't quite figure this one out though.

From:     Andrew Chukwu [andrewchukw@gmail.com]
Date:     27 December 2013 13:24
Subject:     Wire transfer to your account

Please review and follow the instruction to get your payment slip,
please get back to us as soon as you get it

Best of Luck
I know better than to open unsolicited .DOC files, so I put it through VirusTotal.. and it came out clean. Joe Sandbox, Malwr, and Malware Tracker all report it as clean too. In fact, the only thing it seems to contain is the following string:
file:///C:/DOCUME~1/AGV/LOCALS~1/Temp/New%20Invoice.htm
The metadata says:

Os: Windows
Version 5.1
Code page: 1252
Author: AGV
Template: Normal
Last Saved By: AGV
Revision Number: 1
Name of Creating Application: Microsoft Office Word
Total Editing Time: 01:00
Create Time/Date: Thu Dec 26 10:15:00 2013
Last Saved Time/Date: Thu Dec 26 10:16:00 2013
Number of Pages: 1
Number of Words: 8
Number of Characters: 48
Security: 0

The email originates from a Gmail IP address, and given the Nigerian sounding name it could simply be a scam email gone wrong, but I would strongly advise you not to open it in any case, just it case it is something far more malicious.

No comments: