#kuluoz

[threattrack]

Walgreens Order Spam

Subjects Seen:

Order Status

Typical e-mail details:

E-shop Walgreens has received an order addressed to you which has to be confirmed by the recipient within 4 days. Upon confirmation you may pick it in any nearest store of Walgreens. Detailed order information is provided here. Walgreens

Malicious URLs:

rugby-game.com/search.php?w=ZT5EpruzameN92MeSlvI09DbnfrIhx1yqu3wrootEpM=

Malicious File Name and MD5:

Walgreens_OrderID-543759.exe (39CEBF3F19AF4C4F17CA5D8EFB940CB6)

[threattrack]

Order Acknowledgement Spam

Subjects Seen:

Order Acknowledgement <random>

Typical e-mail details:

We acknowledge & confirm your order for <e-mail recipient>, as follows: Find herewith the attached order invoice <random> . Regards, Patricia Richard Sales Co-ordinator Industrial Estate PVT. LTD.

Malicious URLs

bppm.eu/confirm.php?h=dG9tcEBzdW5iZWx0LXNvZnR3YXJlLmNvbQ==

bppm.eu/confirm.php?h=dG9tQHN1bmJlbHQtc29mdHdhcmUuY29t

[threattrack]

US Postal Service Shipping Label Spam

Subjects Seen:

Problem with mail delivery

Typical e-mail details:

Notification Our courier couldnt make the delivery of parcel to you at 20th August. Print label and show it in the nearest post office.   Print a Shipping Label NOW

Malicious URLs

verenaargentina.com/info.php?id=vZpNZLQxgkPCsUpRO0PyMI3uzaiTAE6z5Pveb37iGrk=

[threattrack]

DHL Shipment Notification Spam

Subjects Seen:

Delivery Status Notification ID#[removed]

Typical e-mail details:

DHL Ship Shipment Notification On June 23, 2013 a shipment label was printed for delivery. The shipment number of this package is [removed]. To get additional info about this shipment use any of these options: 1) Click the following URL in your browser:                   Get Shipment Info 2) Enter the shipment number on tracking page:                   Tracking Page For further assistance, please call DHL Customer Service. For International Customer Service, please use official DHL site.

Malicious URLs

ah-nanas.se/main.php?inf=ss00_323

unitedcricketclub.co.za/main.php?inf=ss00_323

dsfstore.ro/main.php?inf=ss00_323

Malicious File Name and MD5:

Delivery_Information.zip (6ea731d13579040c20208dfbc7bddb0f)

Delivery_Information_ID-<random>.exe (560f37022593bf13c4071f4c5dc3b48c)

[threattrack]

FedEx Delivery Notification Spam

Subjects Seen:

Delivery Notification

Delivery Notification ID#<random>

Typical e-mail details:

Dear Client, Your parcel has arrived at June 13. Courier was unable to deliver the parcel to you. To receive your parcel, print this label and go to the nearest office.

Malicious URLs

txwebsolutions.com/main.php?d_info=899_549892719

ehagency.com/main.php?g_info=ss00_323

eup-ecodesign.com/main.php?g_info=ss00_323

roccoracingmotors.com/main.php?g_info=ss00_323

bebmorena.com/main.php?g_info=ss00_323

metrocomoptimist.org/img/info.php?g_info=ss00_323

Malicious File Name and MD5:

Shipment_Label.zip (a95ef37d4d992ac63cbb81e116Ca6d07)

Shipment_Label.exe (fcd9314b644d86eee71cd67c44935fc8)

[threattrack]

Malicious DHL Spam

Subjects Seen:

Tracking Info

Shipping Detail

Order Detail

Typical e-mail details:

DHL Ship Shipment Notification On April 18, 2013 a shipment label was printed for delivery. The shipment number of this package is To get additional info about this shipment use any of these options: 1) Click the following URL in your browser: 2) Enter the shipment number on tracking page: Tracking Page For further assistance, please call DHL Customer Service. For International Customer Service, please use official DHL site.

Malicious URLs

honoredstudents.org/images/index.php?info=841_139088422

eumpharma.com/images/index.php?get_info=ss00_323

sman4-tanjungpinang.sch.id/images/index.php?get_info=ss00_323

aptekapanacea.ru/images/index.php?get_info=ss00_323

istanbulasim.com/images/index.php?get_info=ss00_323

Additional Notes:

None at this time.

[threattrack]

Malicious American Airlines Spam Continues

Subjects Seen:

Your order has been completed

Order #[removed]

Typical e-mail details:

Customer Notification Your bought ticket is attached to the letter as a scan document. To use your ticket you should Download It .

Malicious URLs

caprica-toysncomics.com/components/.a9iifi.php?request=ss00_323

caprica-toysncomics.com/components/.a9iifi.php?ticket=844_220641690

Additional Notes:

None at this time.

[threattrack]

Malicious American Airlines Spam

Subjects Seen:

Please download your ticket #[removed]

Typical e-mail details:

Customer Notification Your bought ticket is attached to the letter as a scan document. To use your ticket you should Download It .

Malicious URLs

bikemania.org/components/.5wl0rb.php?request=ss00_323

Additional Notes:

None at this time.