Clicky

Pages

Saturday, September 3, 2011

Sept 3. Liberating Taiwan: one phish at a time. 2010-2011


chineseposters.net

I will be traveling most of September but I wanted to leave you with something to play with while I am away.
These 175 phishing messages were received over the course of 18 months by one recipient, who also happens to be a former Taiwan government official and an expert on China. The recent exploits used are mostly CVE-2010-3333 and CVE-2011-0611 and CVE-2010-2883 but you will find a good variety, as well as a lot of RAR files with RTLO and exe. The senders and the recipient are in Asia so these document give you a good idea about the phishing landscape there (in many ways it is similar to what you see in USA, for understandable reasons)
There might be a few documents that are not malicious, esp. image files.

The first folder inside zip contains files named as DATERECEIVED_NAME.EXT and the second has the same files named DATERECEIVED_SENDERADDR_SUBJECT_NAME.EXT. Use whichever works for you better. I also posted details about two messages to give you an idea. 





Download the two messages described below plus 175 documents listed in the table as a password protected archive (contact me if you need the password)

175 attachments from phishing messages. Same color cells indicate duplicate MD5 hash.

Filename MD5 File Size Extension


2011-08-31 _ATT25574.doc9cd4fd13f8f62e0cf172ace51b4dfcbf46,243doc
2011-08-30 _ATT97724.doc14a1b3dbdd25cc9a59ab2aead63fd2c346,755doc
2011-08-30 _ATT89844.pdf8b9c1d4561bcade87183345afd45d61e219,622pdf
2011-08-30 _ATT76862.pdfd642d3dde179ce5be63244c0f6534259249,913pdf
2011-08-29 _ATT59379.doc527a6cd21f0514ef5baa160b6e6b1482214,247doc
2011-08-29 _0901.pdf50a713a00c8468f7f033e79a97f6b584249,913pdf
2011-08-28 _ATT44112.doc974136d5b1c72388ce62bd5172f102a948,291doc
2011-08-26 _20110907.pdf61110659d8bd11021957a85d057c1e2e446,822pdf
2011-08-26 _20110907.docfd33f1b078b0bd3a2f888618fbf72ff8165,365doc
2011-08-24 _ATT10933.rarc6f49cef7499ebbc79379feca9c3241036,282rar
2011-08-08 _ATT50833.rar914e0c94a7480af3dc61fddfa79598ad4,081,738rar
2011-08-08 _Agenda - US-Taiwan Defense Industry Conference 2011.zip.txtd233dede5959e470826330c0127326b828txt
2011-08-04 _861-7145.xlsc645169173c835c17abb0bde59b594bb72,725xls
2011-08-04 _2011--TAIPEI.doc60472c9a0f779f3757694467631410d9105,825doc
2011-08-04 _10007-9824584706114A022645-receipt_pdf.rar442b123686acce03dfac61a8d01f2a26507,754rar
2011-08-02 _2011().xlsd7c2014e594cce791f327baf451b1d4f80,917xls
2011-08-01 _ATT81208.docb871ad684b96aa31edb71b9afd8879a297,942doc
2011-07-31 _headlines.doceaf497ea297165d27791ff7aa91bbe1056,483doc
2011-07-27 _ATT43518.rarc7b8bd93bca553bf72da51a6ea6d4b9f695,103rar
2011-07-26 _ATT13628.doccf00dcf06136dcdb717c454d2e9c7aaf381,846doc
2011-07-26 _4 .doc8a23caf9a908d538e13f565be3a1ce1e90,112doc
2011-07-26 _2 .doc2bac52998dc293ac85e46ac70a3460c856,832doc
2011-07-24 _ATT10433.doc8e54c50244bcd8a37534a89e1e7c372b45,731doc
2011-07-20 _agenda_democracy in east asia and taiwan.docdaf8dd025a58a0e2e9e6f2d5a8780857120,483doc
2011-07-20 _-.pdfc94ce81f71c7a31ea1eea2deaee3c62589,279pdf
2011-07-17 _ATT61233.docbbc20e30e1a2fa2afc8a1a2df18ed54763,139doc
2011-07-17 _agenda_democracy in east asia and taiwan revised 0714.docdaf8dd025a58a0e2e9e6f2d5a8780857120,483doc
2011-07-15 _0715().docc01666100691d3ada144d77a1aa8adfe184,483doc
2011-07-14 _ATT84548.docbb2a2fe853f5d212039ca4ce106712a480,547doc
2011-07-14 _ATT16661.docfa071ea3e1eae9ec41db9a03de1bf1a445,731doc
2011-07-13 _ATT23839.rarc895cec71b1dd8f3c4d103e8f1233e4717,955rar
2011-07-12 _ATT05498.doc2457fedce0daf586550b7342e9c6e71c47,779doc
2011-07-10 _ATT62461.doc9fcc27a2afca1d71b7b80433e5c90fd546,755doc
2011-07-10 _ATT30145.rar5c3707ee6566f64454e86cf62774442a92,436rar
2011-07-06 _ATT29299.pdff8c670662bc2043664269671fb9a2288249,913pdf
2011-07-06 _20117.rardfae6b2bfa21c608ec5e7efcc6c9651b1,073,652rar
2011-07-06 _201108.docc191a133f386999a33e1384fcdbad15b80,030doc
2011-07-04 _pic.rarb65aa2653fe21d48aacb2a533934bc9c139,096rar
2011-07-04 _hinet.pdfa3acdec6101ef972098207dc12082289249,913pdf
2011-07-04 _ATT81166.doc1e1f57c47750192f33aca45d7c4e731c36,555doc
2011-07-04 _ATT52694.rara125b6ce88f208cd3e2f852de64f654f49,327rar
2011-07-04 _ATT00596.docdb644edf18fc2a6ecf333181e1a703e048,291doc
2011-07-03 _ATT22223.doc5718f33fd855018319370e12b787e43648,803doc
2011-06-30 _2012.pdf9dc0d932bc582e6a17c65da1bf1ac724249,913pdf
2011-06-27 _ATT94950.docc6e25cdb3b5b45d9cdf041f2ee64370d47,779doc
2011-06-27 _ATT55154.pdf46c6da9be372f64ef17205fd3649fa80249,913pdf
2011-06-27 _ATT53252.pdf002cec5517c17ffac2e37908fcab45ff249,913pdf
2011-06-27 _5.pdfeba9eaa00a9a9f0778abbb7800d1d59d249,913pdf
2011-06-26 _ATT78460.docd0eb8299d15608140b3b893d6b823a5847,267doc
2011-06-26 _ATT71797.pdfb56c86f3605c5c2184e55b8521257965249,913pdf
2011-06-26 _ATT29433.pdfa41186ac5bef467204c721e824b550cf249,913pdf
2011-06-26 _0932141701_10006_notification.pdf02a1a396e3607a5d2f8ece9fc5d65427249,913pdf
2011-06-24 _P-285.pdfc2e05204221d08d09da1e3315b1b77a1249,913pdf
2011-06-23 _ATT33684.pdf5fd41e4d85a34d2bbf0e91c881127106249,913pdf
2011-06-23 _05.pdfe8390f9960e1acb2ca474a05fdbd1feb249,913pdf
2011-06-22 _ATT47042.doc1ca1185784f46d899aa5cb71ef8a606a80,035doc
2011-06-22 _ATT17788.pdf63567bc2dd0833afce4286225d24af18249,913pdf
2011-06-22 _20110623.docbec2995c994d9579e509ce7d8be3813270,819doc
2011-06-22 _20110622.doca5b8d125c0d63966e58d8bb01a8636f770,819doc
2011-06-22 _+v.s. -.pdf75ede0bac1e6e6d51b87b23280f603ca249,913pdf
2011-06-21 _ATT34094.rardca5d0e06e62d4f1b43740633cb14d8d52,308rar
2011-06-20 _().pdfe0255a0bbd6d067bc5d844819fee4ec6249,913pdf
2011-06-18 _ATT59966.rar02fdf49f65b25398d4fef4d222e856b191,172rar
2011-06-15 _ATT06178.rar9bb9600989a5a01d2732bae566f637a83,466,469rar
2011-06-15 _ajkh-03.jpge173925f09848db45fcdb2a34f90435a252,506jpg
2011-06-15 _ajkh-01.jpgf5740e290a2de3438d02ddab600015fc231,885jpg
2011-06-13 _ATT25502.rarc32240468ebc03148c4c060bba5dd9ed89,684rar
2011-06-02 _ATT67265.doc3e53bf95a0e51ce6d15409adf6c0add490,667doc
2011-05-18 _taiwan- resoucod.scr.txtd233dede5959e470826330c0127326b828txt
2011-05-18 _2010~photo.pps.rar7ae26faf263ef9178711d9a1280f46b98,571,782rar
2011-05-18 _1000609agendadoc.rar519b91ad62f18395cde38f0eeebc200160,223rar
2011-05-17 _US Accommodation School from Budding to Rising.rare21fad863a80976742d55025525fe01e56,024rar
2011-05-16 _0932141701_10005__receipt_notification_pdf.rar1758f1c271e6139d2f7916b38cefb429179,973rar
2011-05-13 _ATT19017.rar771ec02db2a5f30858da854af0ff749e53,385rar
2011-05-04 _ATT44473.doca09b5574c001c10511b741fb042090a3108,582doc
2011-05-04 _0504.doc1cadb430344a1e5bbc42f281c02c2299177,152doc
2011-05-03 _ATT09743.doc9ac394fcf3b5638c3a9689030c18582f99,344doc
2011-04-25 _ATT52977.doc4ec04d22f219df990545f93d9e52878d77,839doc
2011-04-19 _813.pdffc65a23d98ad937568d0044c4b39852c118,299pdf
2011-04-19 _813.doc1eaaef7fdfd92a26e63d518d1c2e4c7732,768doc
2011-04-18 _call_for_paper.docf8c5bebcfa45d30eeadf7dc206e99fcb91,198doc
2011-04-18 _ATT38713.rar68a72a6630053fe9f5354ac789348bc959,283rar
2011-04-18 __2.doc8a70bfac553bed08536fc7c71850b56e56,382doc
2011-04-18 _110418.xlse0160a0c9ebf68e5324fb9614f8071fd33,792xls
2011-04-08 _ATT61661.rar6b77ce49533a2d1f628186cffcf8cac590,169rar
2011-04-05 _-0407.rar8997d69ddbc1b37b142426bd6992cd8591,261rar
2011-03-30 _,.rarcfe770857ba0a88d6f5ec3f8fd8e836d91,006rar
2011-03-29 _100.3.rar6336b6ffa87813483337bdbff3e4b6b843,908rar
2011-03-25 _138.pdfe45b294255c913bbf16e95d1045639d9163,216pdf
2011-03-18 _ATT24533.rar72e0f6f29b7eabd7cdf36882cd3a4c47230,148rar
2011-03-18 _2ddae2d7e1b123fb25909a83672724e0.jpg2b464c7b6251b7b3e20d16820181406f41,276jpg
2011-03-18 _2c5264c6f8b301e439137d407e48bb0e.jpgcc2a2baeddb98ed101ec04066ce5732a30,641jpg
2011-03-18 _1(1434).jpga88985e5f9f436060f10f1f04e142dc931,590jpg
2011-03-18 _0015583f84240eecdcaf25.jpg950d9a7101e7fc2b752cfaa57d1a5f4c26,073jpg
2011-03-08 _ATT19907.docb9cebfcba6e7f9ca18852b706506d370114,322doc
2011-03-08 _ATT09400.rarc8a9ece66ac24d0acc5e0ee6acf011a3236,900rar
2011-03-07 _ATT15243.rarf72d16638c574f801499a30c6cd675b289,849rar
2011-03-01 _Take Easy.rar0143175eceacdc11def50300198430bd3,037,697rar
2011-02-24 _2011q20110224.docc38acab908fac3bff6bdd7424f7c7760165,833doc
2011-02-24 _2011.doc21fa925e48a4238e22fef1147f29372764,966doc
2010-12-17 _倂.docfc5c97b5a3f8e18381202a1e79ed3706340,982doc
2010-11-30 _The Cold War's First Conflict.pdfcab8cf6f5d83c54df271749ee296a65f178,058pdf
2010-11-29 _Counting the Costs of Somali Piracy.pdfb04595d059d72109a3e8f9284d79bce8157,226pdf
2010-11-22 _ATT82936.rar224511f38338b79fbc8d3a0f02f46118113,077rar
2010-11-15 _ATT27863.pps896c14bc7ff88923e35aa824ab6c72da2,804,740pps
2010-11-12 __.pdf36af296c3954274f4222847814b1f63b947,737pdf
2010-11-09 _goods_stuff.pps72fa74e7ecb741e4e67993807219a82a2,804,740pps
2010-11-08 _ATT13562.doc5bbdbec981b0708ea29edff2f8d78bcf325,759doc
2010-11-08 _99(1)TA-RA - .rara9efc4e446c0a17157158ba3d2f771b5584,174rar
2010-11-07 _ATT96321.pdf29a74ab0a2d4deca3850fca3813fe345302,718pdf
2010-11-04 _ATT69914.pdf97ab9a60226f2af051251255254e8fbf278,987pdf
2010-10-29 _ATT29632.pdfbd4d584dffedcdeb0efc0b362ff73db8278,987pdf
2010-10-29 _32.docf74910cb5a801b2f9fbe873a994b4ff7906,240doc
2010-10-27 _Document.pdfa49bb6ef5a11469788f1f5bc1f49eb8c278,987pdf
2010-10-27 _Document-1.pdfa49bb6ef5a11469788f1f5bc1f49eb8c278,987pdf
2010-10-26 _p09.xls7b9e1c1b479447506cc046a5d8219eca167,191xls
2010-10-22 _ATT25721.pdfdd3dee576d0cb4abfed00f97f0c71c1d278,987pdf
2010-10-21 _0101514282767.pdf5c31ef69086467c073dde69cf329855539,278pdf
2010-10-21 _010151428148.pdf22f3e7e6f64217628f97d09cdaa1810d39,278pdf
2010-10-06 _ATT93278.pdf4407f42fa696c32ca473bead96e36aca358,996pdf
2010-09-17 _990917.rara6a792fb5612834debc650a946bae9a153,281rar
2010-09-16 _-2.doc5800f546b535bd2b4e505b5c9be753ff83,456doc
2010-09-16 _-1.doce8dad8f3b10301d91e439ed802c35b55111,104doc
2010-09-14 _ATT90838.doc6f70e1815fe09fad9346a45b95eeb3e6226,646doc
2010-09-07 __9.xls0ab4a29af51b17335abbe0eb861784aa236,728xls
2010-08-25 _ATT74891.pdffdf50b8fb25b2ef33d42917108c9d5e7172,215pdf
2010-08-23 _ATT72404.pdffae3f3507bd51b91f2255c99641b6f5770,843pdf
2010-08-20 _ATT16217.doc6634eacd3dae03be9767ac91b71decba83,456doc
2010-08-17 _ATT39500.pdf72d6d864205b0f1b32bbc9a7e5184ee743,867pdf
2010-08-17 _2010.pdf72d6d864205b0f1b32bbc9a7e5184ee743,867pdf
2010-08-16 _20100816.pdfa3f87c9468e0850cc5e5ab16c639cb31146,353pdf
2010-08-09 _F5F2.rar6148b09fcb4ffeab737f9ed1318bb0f065,434rar
2010-08-08 _89912088_9907_receipt.pdf52d01b4301550c18f76926d53e80299468,976pdf
2010-08-06 _-v_.pdf4378bb2be0e41569bcce202f86e505f639,494pdf
2010-08-06 _-_.pdf576b214a1e5b6649f6677e20315a7ea938,362pdf
2010-08-03 _ATT30078.pdf911eb6c6524711c194320461b1602ace148,557pdf
2010-08-01 _(99.08.02).pdf3aed2adc1018d4c39080ab412e26654c101,847pdf
2010-07-28 _TOP5.pdf03042cc3786dafdb941019488d4cad3e67,097pdf
2010-07-28 _-990729.pdf738af108a6edd46536492b1782589a04103,100pdf
2010-07-27 _99(0727).pdf2d78b8b7c5ca2101c52c7508cd3af9e4109,766pdf
2010-07-26 _ATT21407.pdf7f73dd439572409a64bc4dd0d603aacf154,204pdf
2010-07-25 _8.xls790b4a2c03086bd1917433a5084d206886,804xls
2010-07-21 _o covmes ucheniiakh SHA i yuzhnoi korei.pdf6d74e61ff49761920b1cbeeb92f9cc05581,514pdf
2010-07-19 _ECFA.pdfe1fcbc9bcfb197ee47a94eee4ef41c0c137,016pdf
2010-07-18 _--.pdf82eeda4a754bf163d406e3e205df97e9209,428pdf
2010-07-12 _ATT73820.pdfe9d4bfdaf546a9837de360cfac9902aa182,072pdf
2010-07-12 _ATT54496.pdf004e74d54dcf79c641d5cf8a615488a0117,947pdf
2010-07-11 _ATT50892.pdf10c35deb541e58b115ea2c682edb26ea150,374pdf
2010-07-11 _ATT44082.pdf940ae58370cd3ed31f9fd7ca8672fa27104,059pdf
2010-07-07 _pdf7b80f7ed7052405cdf6434ff5bc7c175210,446 
2010-06-08 _ATT77316.pdf100cf902ac31766f7d8a521eeb6f8d68221,345pdf
2010-05-19 _,.rar34bae9794068b028840be54cf138214983,189rar
2010-05-18 _-,MM,.rar7cd505009a27e40f38b4a8fbde20a95c84,101rar
2010-05-17 _,.... .rar60453b0a3fbc02109ff4419e5c3f4cc583,237rar
2010-05-14 _!.rar60453b0a3fbc02109ff4419e5c3f4cc583,237rar
2010-05-13 _ATT42396.xls61a29b7d8a6c3a03a884f2f64be5ca2164,512xls
2010-05-11 _0516.pdf2aaa2f62cadf2b0f72587b3dffaee66987,347pdf
2010-05-11 _0516.docc3d632ffe97314c1d77ad479d6591bd6755,712doc
2010-05-10 _ATT39755.xlsd4b98bda9c3ae0810a61f95863f4f81e72,192xls
2010-05-07 _GVSRC_PID_201004_C.pdf116c4ad3656000b7c0908c13470d0001128,193pdf
2010-05-06 _ATT59802.pdfd80eb21cfe8ad1a710c8652b13f8b7ac106,855pdf
2010-05-05 _ATT65990.rar48de8a5504185b19712c577c3be8a8f684,229rar
2010-05-03 _2010 .pdfa2f55af4a8d8e17530651ce4cc47a21a87,347pdf
2010-05-03 _2010 .doc9c916a888d5732f4b03cee49a33106c4211,968doc
2010-05-01 _ATT16747.pdfe6f110cf24ff8f7aaa7d8aeba3e71d1694,443pdf
2010-04-28 _jpg.rar30c626c728fd207c434aea0ce2fff2302,945,218rar
2010-04-28 _14.jpg1900303e5b7e65f27490b3fe3e1dae27371,632jpg
2010-04-28 _13.jpg0e5c0ce94ae53bff742beeefbf965d19392,597jpg
2010-04-27 _2010.DOC.rar6da1a703f1f20fdc07c8cc3b6523fb0567,124rar
2010-04-26 _RSIS C 41-2010 Li Mingjiang.doc222c10d78a033b24d8e41a0a5d5696f456,320doc
2010-04-26 _RSIS 41_2010.pdff603d7bd0f9400fe59444106cf1f6c9d57,236pdf
2010-04-26 _MCSS().pdf01c4a872de65158281eb8275c5bf893780,058pdf
2010-04-26 _ATT85645.pdf58de08c1155a775b760049dff3f5abe4115,796pdf
2010-04-26 _ATT42909.pdf536c0afe4d655a66dccad4af9679caa9129,722pdf
2010-04-26 _9904.pdfd824959ed2d54da5d6075eff69b4a482590,007pdf
2010-04-26 _.lnk.txtd233dede5959e470826330c0127326b828txt
2010-04-25 _-.pdfbbd68472ad0688005cf40d726efdb2be101,024pdf
2010-04-18 _ATT13624.pdf10e15dd9b11528762c182b04f80e0a03132,797pdf
2010-04-15 _ATT95097.pdf5b7541f3648cc440405179cb5c19464480,199pdf
2010-04-12 _ATT22152.pdf1fd0cd90cbd69234d07b4172bbad754d114,148pdf
2010-04-06 _0406.rar93a08f2d2916357737964ffc0d2b636527,524rar
2010-04-03 _ATT93841.rardebf5e6ca4828a4bd6a91422246952c0128,622rar
2010-04-03 _990508_.pdf04c6f935a743a827cd918026be5f0605142,174pdf
2010-03-31 _-990331.pptfa1ae228ece85febeb73c75f1f34fe2e631,296ppt
2010-03-31 _-99031.doc8b35cf81136939b6218d1e1b44d9ae6334,115doc
2010-03-25 _conference memo.PDFc9c89ebc508c783defe7042eb9c0e5cc76,137PDF
2010-03-25 _ATT70176.pdfbb10a59bf2b697f649d47dadf52aebd580,199pdf
2010-03-25 _ATT37905.pdfbb10a59bf2b697f649d47dadf52aebd580,199pdf
2010-03-24 _ATT43728.pdf3abe00a1d0dc816a99587f574d02b498157,085pdf
2010-03-23 _ATT59244.ppt6d30b24fb35a9e7310d5029b73685a07631,296ppt
2010-03-17 _2010.pdfb86aa7fb2174d073155213cb9e23c52f240,872pdf
2010-03-10 _[].pdfbbdce0ad4cd7268f8454b7da526aa09c240,872pdf
2010-03-08 _ATT11103.rard98f9491192a49676844e65de0c01c3f241,852rar
2010-03-08 __.pdfcdb5e82e4d07911f9add5cdcf817e9ed80,199pdf
2010-03-06 _ATT64535.pdf59c99b168ff2b58040bda0c726141215115,147pdf
2010-02-22 _Taiwan 2010.doc9ef09819aa5d552ecb15067a14a33152183,808doc
 

The second folder contains the same files but named DATE_SENDERADDR_SUBJECT_NAME.EXT - they have very long names and difficult to handle and hash but they provide more information. To correlate with the files with short names, look for the name portion of any filename. Screenshot of files is below




Example #1 Aug 30 CVE-2010-3333 DOC from 210.176.165.190 with Taidoor/Rubinurd

 CVE-2010-3333 

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

Attachment
MD 527a6cd21f0514ef5baa160b6e6b1482
Type: Doc

Sender
ynlin@oop.gov.tw  - Taiwan Gov
210.176.165.190 Hong Kong, AGIO INTERNATIONAL CO LTD
X-Mailer: OutLook   6.1.1.0 

Note:
from strings

http://www.tvbs.com.tw/news/news_search.asp?p=1&T1=

DocumentSummaryInformation
WordDocument
WPS Office
KSOProductBuildVer
2052-6.5.0.1966

From payload\Local Settings\Temp\1.doc
\Local Settings\upnphost.exe http://www.virustotal.com/file-scan/report.html?id=10e3d66095582f22637c6f44e152338f5696ab212833481b001153a9570f29dd-1314939724

CC

206.11.214.29
Onvoy
300 South Highway 169
Minneapolis
MN
55426
United States

GET /nztwx.php?id=011151191138FEBC54 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: 206.111.214.29
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 15
Content-Type: application/octet-stream
Connection: Close
....}R.........

Strings from upnphost.exe

mK5l
l,qE
quEh3
;t6EqFG.
0n4cw
W)dl
ntdll.dll
NtUnmapViewOfSection
host.exe "
vices.exe "
SOFTWARE\McA
GetModuleFileNameA
kernel32.dll
abcde

Unicode Strings:
---------------------------------------------------------------------------
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
---------------------------

Headers

 Received: (qmail 23063 invoked from network); 30 Aug 2011 02:15:10 -0000
Received: from msr17.hinet.net (HELO msr17.hinet.net) (168.95.4.117)
  by xxxxxxxxx
Received: from COMPUTER ([210.176.165.190]) Hong Kong, AGIO INTERNATIONAL CO LTD
    (authenticated bits=0)
    by msr17.hinet.net (8.14.2/8.14.2) with ESMTP id p7U2F39C006490
    for xxxxxxxxxxx Tue, 30 Aug 2011 10:15:05 +0800 (CST)
Reply-To: ynlin@oop.gov.tw
From: "=?BIG5?B?qkzgsaRr?="
To:xxxxxxxxxxxx
Subject: =?BIG5?B?qv6l8w==?=
Date: Tue, 30 Aug 2011 10:14:27 +0800
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/mixed;
    boundary="----=_NextPart_11083010024767185485574_000"
X-Priority: 3
X-Mailer: OutLook   6.1.1.0 (is it really Outlook?)
-----------------------------------------------------------------------------
Message Text

From: 林鈺女 [mailto:ynlin@oop.gov.tw]
Sent: Monday, August 29, 2011 10:14 PM
To: xxxxxxxxxxxx
Subject: 附件
Importance: High

From: Lin Yu F [mailto: ynlin@oop.gov.tw]
Sent: Monday, August 29, 2011 10:14 PM
To: xxxxxxxxxxxx
Subject: Attachment
Importance: High

-----------------------------------------------------------------------------
Virustotal scan/report.html?id=b3941bdf1703ec385ead72f78e9676b3f59519462a94a6879ba1b3d9c4125cbe-1314860977

Antivirus     Version     Last update     Result
AhnLab-V3     2011.08.31.01     2011.08.31     -
AntiVir     7.11.14.60     2011.08.31     -
Antiy-AVL     2.0.3.7     2011.09.01     -
Avast     4.8.1351.0     2011.08.31     RTF:CVE-2010-3333-L [Expl]
Avast5     5.0.677.0     2011.08.31     RTF:CVE-2010-3333-L [Expl]
AVG     10.0.0.1190     2011.09.01     Suspicion: unknown virus
BitDefender     7.2     2011.09.01     Exploit.RTF.Gen
ByteHero     None     2011.09.01     -
CAT-QuickHeal     11.00     2011.08.31     -
ClamAV     0.97.0.0     2011.09.01     PUA.RFT.EmbeddedOLE
Commtouch     5.3.2.6     2011.09.01     CVE-2010-3333!Camelot
Comodo     9947     2011.09.01     -
DrWeb     5.0.2.03300     2011.09.01     -
Emsisoft     5.1.0.11     2011.09.01     -
eSafe     7.0.17.0     2011.08.31     -
eTrust-Vet     36.1.8533     2011.08.31     -
F-Prot     4.6.2.117     2011.08.31     -
F-Secure     9.0.16440.0     2011.09.01     Exploit.RTF.Gen
Fortinet     4.3.370.0     2011.08.31     Data/CVE20103333.A!exploit
GData     22     2011.09.01     Exploit.RTF.Gen
Ikarus     T3.1.1.107.0     2011.09.01     -
Jiangmin     13.0.900     2011.08.31     -
K7AntiVirus     9.111.5077     2011.08.31     -
Kaspersky     9.0.0.837     2011.09.01     -
McAfee     5.400.0.1158     2011.09.01     Exploit-CVE2010-3333
McAfee-GW-Edition     2010.1D     2011.08.31     Exploit-CVE2010-3333
Microsoft     1.7604     2011.09.01     Exploit:Win32/CVE-2010-3333
NOD32     6426     2011.09.01     -
Norman     6.07.10     2011.08.31     -
nProtect     2011-08-31.02     2011.08.31     Exploit.RTF.Gen
Panda     10.0.3.5     2011.08.31     -
PCTools     8.0.0.5     2011.09.01     -
Prevx     3.0     2011.09.01     -
Rising     23.73.01.03     2011.08.30     -
Sophos     4.68.0     2011.09.01     Exp/20103333-A
SUPERAntiSpyware     4.40.0.1006     2011.09.01     -
Symantec     20111.2.0.82     2011.09.01     -
TheHacker     6.7.0.1.287     2011.09.01     -
TrendMicro     9.500.0.1008     2011.08.30     Possible_ARTIEF
TrendMicro-HouseCall     9.500.0.1008     2011.09.01     Possible_ARTIEF
VBA32     3.12.16.4     2011.08.31     -
VIPRE     10334     2011.09.01     Exploit.RTF.CVE-2010-3333 (v)
ViRobot     2011.9.1.4650     2011.09.01     -
VirusBuster     14.0.195.0     2011.08.31     -
MD5: 527a6cd21f0514ef5baa160b6e6b1482
SHA1: 21c1eb1489fe85d9fb31f72b86d96e6856d4807e
SHA256: b3941bdf1703ec385ead72f78e9676b3f59519462a94a6879ba1b3d9c4125cbe
File size: 214247 bytes
Scan date: 2011-09-01 07:09:37 (UTC)
-----------------------------------------------------------------------
Partial Strings from the document

File: ATT59379.doc
MD5:  527a6cd21f0514ef5baa160b6e6b1482
Size: 214247

Ascii Strings:
?}|{z>
lls876YXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
yxvvttyr1pZnllaj)hRfedcba`_^Y\[Z[XWVUTSRQPONMLKJ'KGFDD
B5@M>T
vUt:r
^3\2Z7X$V!T2R=P#N(L9JiHvFuDmBp@
48200i.D,G*L(q&@$Q"R v
|Yzxx;v
`7^)\[Z
X8V%T*R#P&N*L#J=HgFzDcBp@
.l,O*F(E&@$
|_zxx'v
ba`_^
\7Z8X$V=TlRqP
N!L*J0H"F7DcB
@Q>N
.x,E*@(I&V$W"@ s
~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
df`fdddddeeee
e-rp
KSKS
e-rp
P}_g^
P}_g
P}_g^
NASrkMR
ASkQ
lQYe
T*QX[)Ro`
yY1\
TZf1Xq%,{A
eyrf
_sOR
e;N5_s
4lAb
SlQs^
FOyrf
/f6R
T1Xq%,{A
Abyrf
1\/fL
?e_j
vcw/f
lHh8^
q%-N.Y>y
&NOU
=~q}
W?e3
=~q}N
?e>~
=~q}iR
N0R1
iz.}izSb
\Bl#
/ehy
q%-N.Y>y
=~q}h
v
q%-N.Y>y
%kQt^=~q}'Yx
+cWe
Nt^gQb`
_CQ#l
pyYvu
;N-^KN
>eKb
g!qP
T1X,{A
vuBf
}8^~byY
k^yY
TSFU
s^GRk^
T1Xq%,{A
NX[(W
c}Y~^
p'Yx[
YZP#
T'Yx[
N)YSb
q%-N.Y>y
0oRKbx
VhQvuoRKb
ckoR=~q}
06^N
VhQGR
0FO!
l\4s
l\4s
T1Xq%,{A
=~q}
\uR
]\O_j
0lQs^
l9ei
&N6^
Xckck
T1X,{A
/f&T
tKNU
yYvux
=~q}
vTSp
T1Xq%,{A
TPk2m
ScpTS
]!q~^
gmQ~v,
1\(W
YUO-r
NAS,
q%-N
WBf1Xq%,{A
VAS~^rk
NSbMR
px[K
Ns^a
/fyY
T1X,{A
S0RN
}i[P[
qS_jU
\i[P[p
0R6b
1uBf1Xq%,{A
;N-^!
bo!|
lQLh
gyr%R
WBf1X
e(f)Y
0yYh
1uBf1X
Nt^Bf(Wdkx
l4xmQ
q%-N
WBf1Xq%,{A
Hrq%?e
\=~q}
\|vU\
Scp/f
0/fiQ
=~q}
T1Xq%,{A
Hrq%
s4X/e
j/fN
=~q},d
e1Xq%,{A
eybU
=~q}
l9ei
N~^MO?e
l9ei
=~q}
=~q}@b
1\/f
NZP?e
vu6q
l9ei
yYGR
^'`9ei
_9h,g'`OUL
1uBf1Xq%,{A
Hrq%
yY/f
Bl/e
[3^Hh
Nrs)R
Nrs)R
NePhQ
0zlV{
NlQs^
T1Xq%,{A
Hrq%
/ehy
SHh*g
W#~/f*g
NE\OO
S?eV{
q%-N
WBf1Xq%,{C
Hrq%
yY7_
-N.Y
'`ybU
[/fP[[
q%-N
WBf1Xq%,{A
Hrq%?e
U|Qg
l;e2
RI{3
eMRlQ
q%-N.Y>yq%
WgQ?e
e(f)Y
t^FU
N+^lQ
N1\/f
NMR%R
q%-N
WBf1Xq%,{A
Hrq%
N4Xx
v/f=~q}
bhy/e
MOsY'`=~q}
v=~q}
q%-N.Y>y
WgQ?e
yY(W
0'YE^
O9eiQ
WBf1X
Scp?e
f/f8^Ka
\?eV{
b/f^
/fOU?e
-N.Y>y
WgQ?e
b(f)Y(W
b/f*Q
FO_N
0FOL
Kb_j
e6Rbk
N)Y`O
1uBf1X
1\/f
NLu^
/fhQ
0yY7_
ScpSb
1uBf1X
0(f^
wBfzz
T1Xq%,{A
S>y>yw
ft^'Yx
_=~q}
#jMb
Bl*Y
1ULk
-N.Y>y
WgQ?e
?eV{
(W,{
T1Xq%,{A
eybU
Ny_*g
fyYMc[
N>eq
v7\,\4Xb
PW(W
vMRL
-N.Y
&N(W
kp#l
Y>eq
/fyY(W
g-rp
q%-N
WBf1Xq%,{A
eO\qg
gvux
=~q}
PsY=~q}
v=~q}
-N.Y>y
WgQ?e
SMR=~q}
4lAb
Scphs
FOvux
gf}'Y
a!qna
v"Y{^KN
SoR=~q}
Np`vu
POUL
V }MR
q%-N.Y>yq%
WgQ?e
vD}T~
_1\/f
Yd\!kD}T~
lOUL
vybU
0D}T~
-N.Y>y
WgQ?e
\1u=~q}
v%Y4O
|_dk
ehsyr
u;m|vU\
q%-N.Y>yq%
WgQ?e
W?eBf
v?eV{
lhsyr
b'Y=~
%kQt^
g1\w
'YxQ-N
S?eV{
l;N2
\1u=~q}
q%-N
WBf1Xq%,{A
e(f)Y(WO\qg
=~q}
S(WkQkQ
Mb0R}p@S
}8^cw
S}p0W@S|vU\
ob_Ka
T1Xq%,{A
eybU
kQkQ
=~q}
eQOO
R7_cw
q%-N
WBf1Xq%,{A
W?e3
QCQ0R5
N!kx
=~q}
T1X,{B
v=~q}/fvu
RKN%`
Pc>k
/eMb
z6RP}
,g)R
glQs^ck
q%-N.Y>yq%
WgQ?e
W?eMb
?eV{}r
\mid\!kOUL
N Y0}
T?eV{
p`vu
T1Xq%,{A
W?eBfMb
I{Bf
?eV{}r
\mid\!kOUL
N Y0}
T?eV{
p`vu
T1Xq%,{A
e(f)Yh
\mid\!k
N?eV{
p`vu
W?eBfMb
q%-N
WBf1Xq%,{A
\mid\!k
W?eBfMb
I{Bf
T1X,{A
l6eeQ#
te%m
lQYe
elQs^
yr%R
teBf
gckvu
q%-N
WBf1Xq%,{A
P(u^
_N/fw
1uBf1Xq%,{A
g(WL
;N-^Bf
vX[>k
0|Tr|'Y
Pc>k
q%-N.Y>yq%
WgQ?e
v?eV{/f
v?eV{
v;N5_
8^le
T1Xq%,{A
P}_g
l;N2
;N-^!
N)Yh
lQYe1
`X[>k6R
$\vQ
`X[>k@b
-N.Y>y
N)Yh
a9ei
s(W1\
I{0R
yY&N
uOlQw
eQlQ
glQs^ck
izeP0W
\]RjY
-N.Y>y
;N-^!
e(f)Y
0OUL
&q(W6R
v9ei
&q(W6R
^9ei
0yYh
)Ro`PcZPlQ
RPcf}>y
e(f)Y
RBfeuo
aBToR=~q}
Shs8oq}
[Si/n
O\qg0W
v9h(W
lteJ
_teJ
1\/fvu`Ob
eP}_g>m
=~q}
N0RMO
=~q}
N=~q}
~^)YyYx
t^8h
NI{_
-N.Y>y
iQ!k
;N-^
qQs~
NmQ~v,
=~q}
N~v,
l6eeQ
NLu9e
o|vU\
"umiP}
'Yx[
-N.Y>y
{\Omi
g!qU
-N.Y>y
vOUL
[OUL
]N{S
[1z8h
lOUL
_Ka/f
WBf1X
o|vU\
W?e/f
S0R"umi
S0RP
s(W'Y
Yuf}
W?eBf
s(W=|r
W?e1\
ZP0R
v8l`
v8l`
MR-N.Y
xvzb
;N-^
bKNMR
bck(W
;N-^
-N.Y>y
e(f)Yh
=~q}
=~q}
Ts^KN
Scp;N
vOUL
WBf1X
_sOR
a0R^
_sOR
f/fyYle
-N.Y>y
S0R1
iQ)Y~^NN
!kJi
0yYybU
T*g(W,{
N|vBf
vMRiQ)Y?e
1\/f
WBf1X
=~/f
\yYZPN
yY_N
]N=~q}S
e6q-
l1\r
s^o`
Ovu\Ox
p\Op
1uBf1X
e(f)YlQ
=~q}
yY|Tr|x
lCS,
Nvux
{uR
1uBf1X
\(W4X/e
^/fs^Kb
*`*`
-N.Y>y
NybU
ON0W
gZPN
^{S/f
vQ@b

["umi|vU\
yY&N7_
6qyY(uiQCS
CQ(W-N
FOvQ-N
V~v,
CQ/f
z+PGR/f
=~q}
s(W@b
/fl\
0lQqQp
^/fvu%R
Qe}p
/fck8^
>e'Y
FOjR-
;N-^!
eMRh
v?eV{
eMRh
\?eV{iz
v?eV{
\?eV{
z(Wiz
?eV{
1uBf1X
e(f)Yh
l4l/f^
g-N.YMb
chQ@\
0-N.Y
l4lOUL
g-N.YMb
chQ@\
0-N.Y
\OUL
1uBf1X
;N-^!
e(f)YGRh
yY_N
0k^>m
Nk^k^;N
{S_N
1uBf1X
6q/fiQ
\/f&T
b8^8^
eGRh
W?eBf
vHhP[
sOUL
NOUL
W?eBf
W?eBf
cf}MR
W?e{S
`Oy^
1uBf1X
yYMb/f
}wk1\
yY(W
W-N.Y
e0R-N.Y
=~q}{S
=~q}
Scp>y
JT1\
;N-^!
e(f)Y
|vHhzlV{
0vu0WE\
(WE\
0"umi
vzlV{
_N/f,nf
W?eBf
WIQkQ
W,g?eV{
'Ykp
'Y4x
-N.Y$\vQ/fL
=~q}
\,gHh
FO0R
w0R-N.Y
v,n-N
;N-^!
e(f)Y
oTSp
0/f}Y
0FOyY_N
r Tkp
Y}Y}YSbx
N=~q}x
/f}Y
v?eV{
)R(u
W?e*Q
N0Rw
vOUL
0FO/f
r Tkp
P}Y}YSbx
r Tkp
v|vU\
ZP'Y
1\/f*g
|vU\
w0R=~q}(Wl
S0R%R
=~q}
S/f(W
(W@b
1uBf1X
=~q}vuBfOO
\Bf(Waw
yYGR/f
z@bb
vOUL
YxeBf
(Waw
gvu6q
e1\MR
=~q}vuBf
\Bfaw
z@bb
vOUL
vzfgaP}vf
1uBf1X
e(f)Y7_
;N-^Bf
g'Y>w
R>k/e
1\/f
VwcK
,gMO;N
Mb/f
T|vU\
k!q;N
NlQs^
=~q}
lx[Ye
N2ozz
b/f*g
1\/fyY
0/fZ
[/fZ
FOte
WBf1X
;N-^!
Scpq}
v~^ASt^
Scp'`
Scp;N
NMR-N
W'`/f;N
Scp'`/f
1uBf1X
gvux
zlV{*g
_@b2k
^tV4l`l
vMOP[
b1\(W
/fyY
1\/f
;N-^
e(fZfh
^bk%
0\Pbk
vuBf
F\Bf
g\Pbk
e(f)YfW
=~q}
N>m)Y
p=|%
P0W@S1\
WgQ1\mi
P
/f(W
Scpp
t0beu
Scp(WhQ
S-NUO
e(Wqg
'Yx[
s(Wb
Scpb
c0bBf
gjm+o
cNbW
~^!kx
1\/f4
-N.Y>y
{xnd^T
jg]SMC
gdZPJ
a^VLF
}smc
vsicY
vroe_U
vlf\
zpg]
ocYMC
rf\PF=
vlcYM
si]TQG=
|rf\
yof]QG;
{qh^RIF<
vlf\
~xnbX
wmdZ
~tkaUK
paTE<9
udUD
h_]N>
scTG
ph333
ph333
ph333
ph333
ph333
[QK<
ph333
yli_YJ=0
raRA2
qbQB
ufYJ
rhbSC4
rcVG
]SM>1
aPA0
wqeZNC
tj^PD
f\VH
lbXJ;
ymgZL?
teWJ<
]ZWK?
r`^P@
jg[OI;
rea^RF@
tldZQM
zrlhb^
ztpmifb
wtld
vskea
|xuqo
|vrokd`
|tnjd`
W[SO
vU_
wiSO_
wiSO_
e-rp
 " % & ' 2 t%

Unicode Strings:
---------------------------------------------------------------------------
Root Entry
SummaryInformation
DocumentSummaryInformation
WordDocument
WPS Office
KSOProductBuildVer
2052-6.5.0.1966
0Table
Data
 TOC \o "1-1" \h \z \u
HYPERLINK  \l "_Toc301985224"
 8/18
 PAGEREF _Toc301985224 \h
HYPERLINK  \l "_Toc301985225"
 PAGEREF _Toc301985225 \h
       
HYPERLINK  \l "_Toc301985226"
 PAGEREF _Toc301985226 \h
 8/18
100-04-28
100-05-15
100-05-15
100-05-15
100-05-15
100-05-20
100-05-20
100-05-20
100-05-20
100-05-20
100-05-20
100-05-20
100-05-20
100-05-21
100-05-21
100-05-26
100-05-26
100-05-29
100-05-29
100-06-04
100-06-04
100-06-09
100-06-09
ECFA
100-06-09
100-06-09
100-06-11
100-06-11
100-06-18
100-06-18
A14C
100-06-28
100-06-28/
100-07-01
100-07-01
100-07-03
100-07-03
100-07-03
HYPERLINK "javascript:peopleNews(94,'
');"
100-07-03
100-07-03
100-07-03
100-07-05
HYPERLINK "javascript:peopleNews(94,'
');"
100-07-05
100-07-05
100-07-05
100-07-06
100-07-06
100-07-08
100-07-08
100-07-09
100-07-09
100-07-11
100-07-11
100-07-16
2012
100-07-16
100-07-19
100-07-19
100-07-19
100-07-19
100-07-19
100-07-19
100-07-20
100-07-20
100-07-21
100-07-21
100-07-22
2011-07-22
100-07-24
100-07-24
100-07-28
2011-07-28
100-07-28
HYPERLINK "javascript:peopleNews(576,'
');"
HYPERLINK "javascript:peopleNews(314,'
');"
2011-07-28
100-07-29
2011-07-29
100-07-29
HYPERLINK "javascript:peopleNews(96,'
');"
2011-07-29
100-07-31
2011-07-31
100-08-01
2011-08-01
100-08-02
2011-08-02
100-08-07
2011-08-07
100-08-07
2011-08-07
100-08-08
4000
5000
2011-08-08
100-08-09
2011-08-09
100-08-11
2011-08-11
100-08-11
2011-08-11
100-08-11
2011-08-11
100-08-12
2011-08-12
100-08-12
2011-08-12
100-08-17
2011-08-17
100-08-18
2011-08-18
100-08-18
2011-08-18
100-01-05
100-01-12
100-01-15
100-01-15
100-02-22
100-03-17
100-03-23
100-03-25
2025
2000
100-03-29
100-03-31
100-04-02
ECFA
ECFA
100-04-03
HYPERLINK "javascript:peopleNews(94,'
');"
100-04-04
100-04-06
100-04-07
HYPERLINK "javascript:peopleNews(94,'
');"
HYPERLINK "javascript:peopleNews(122,'
');"
100-04-14
100-04-14
100-04-23
TVBS
100-04-27
99-11-23
99-11-10
99-11-01
99-10-30
99-10-11
99-10-01
99-09-30
99-09-30
99-09-30
99-09-30
99-09-23
99-09-23
99-08-30
99-08-28
99-08-25
99-08-11
99-08-11
99-08-08
99-08-05
99-07-29
99-07-29
99-07-27
99-07-27
99-07-26
long stay
long stay
longstay
99-07-25
longstay
99-07-25
Long stay
longstay
99-07-24
2008
99-07-13
99-07-03
99-06-27
ECFA
99-06-17
ECFA
99-06-02
99-05-26
99-05-24
HYPERLINK "http://www.tvbs.com.tw/news/news_search.asp?p=1&T1=
TVBS
99-05-07
99-05-04
99-04-28
ECFA
99-04-27
99-04-26
99-04-26
99-03-15
PAGE
NUMPAGES
apple-converted-space
Footer Char
Heading 1 Char
apple-style-span
Header Char
header
List Paragraph
Normal (Web)
footer
Times New Roman
Symbol
Arial
Courier New
Wingdings
Calibri
BatangChe
PMingLiU
Cambria
GulimChe
_GB2312
Helveti
Courier New
MingLiU
Segoe UI
Courier New
BatangChe
_GB2312
GulimChe
Courier New
Courier New
8!),.:;?]}
_GoBack
_Toc301985224
_Toc301985225
_Toc299443565
_Toc301985226
-----------------------------------


Virustotal scan:
Posted by Mila at 3:22 AM Tags:

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)
Home