Showing posts with label Vir-Exploit/Zordle.gen. Show all posts
Showing posts with label Vir-Exploit/Zordle.gen. Show all posts

Tuesday, December 22, 2009

Dec 22 Exploit/Zordle.gen Attack of the Day US China Statement from spoofed sender Tue, 22 Dec 2009 22:26:45



Download infected US China Statement.pdf (Password protected archive, please contact me if you need the password) 




The message sender was
    Spoofed
 message recipients were
    XXX@XXX.XXX
The message was titled US China Statement.
The message date was Tue, 22 Dec 2009 22:26:45 +0800 The message identifier was <08db01ca8312$f3b7a7f0$9301a8c0@testacb8580da5>
The virus or unauthorised code identified in the email is:
>>> Possible MalWare 'Exploit/Zordle.gen' found in
>>> '5964330_4X_PM6_EMS_MA-OCTET=2DSTREAM__US=20China=20Statement.pdf'.
>>> Heuristics score: 201



Monday, December 21, 2009

Dec 21 Attack of the Day.Exploit/Zordle.gen Information on the forum invitation from Yenfei.Su@gmail.com Tue, 22 Dec 2009 11:08:24 +0800


Download infected pdf as ForumInvitation.zip (Password protected, please contact me if you need it)


The message sender was
Yenfei.Su@gmail.com
The message originating IP was 168.95.4.116 The message recipients were
XXX@XXX.XXX
The message was titled 座談會邀請資料
The message date was Tue, 22 Dec 2009 11:08:24 +0800 The message identifier was
The virus or unauthorised code identified in the email is:
>>> Possible MalWare 'Exploit/Zordle.gen' found in
>>> '5963899_4X_PM5_EMS_MA-OCTET=2DSTREAM__=A5=C9=A4s=B1M=C3D3=AD=D7.pdf
>>> '. Heuristics score: 201


Headers
 Received: from msr32.hinet.net (HELO msr32.hinet.net) (168.95.4.132)
  by XXXXXX SMTP; 22 Dec 2009 03:07:58 -0000
Received: from IBM-62979760B13 (61-218-117-75.HINET-IP.hinet.net [61.218.117.75])
    by msr32.hinet.net (8.9.3/8.9.3) with ESMTP id LAA19335
    for XXXXXXXX: Yenfei.Su@gmail.com
From: "Yen-fei Su"
To: XXXXXXXXXXX
Subject: =?BIG5?B?rnm9zbd8wdy90LjqrsY=?=
Date: Tue, 22 Dec 2009 11:07:38 +0800
Message-Id:
MIME-Version: 1.0
Content-Type: multipart/mixed;     boundary="----=_NextPart_09122211024143786257804_000"
X-Priority: 3
X-Mailer: DreamMail 4.5.0.0Received: (qmail 8043 invoked from network); 22 Dec 2009 03:07:58 -0000