#tepfer

[threattrack]

Malicious eFax Corporate Spam

Subjects Seen:

Corporate eFax message from [removed]

Typical e-mail details:

You have received a 3 fax at 2013-05-07 10:24:18 CST. * The reference number for this fax is [removed]. Please visit efaxcorporate.com/corp/twa/page/customerSupport if you have any questions regarding this message or your service. You may also e-mail our corporate support department at corporatesupport @mail.efax.com. Thank you for using the eFax Corporate service!

Malicious URLs

116.122.158.195:8080/ponyb/gate.php

mail.yaklasim.com:8080/ponyb/gate.php

debthelpsmart.org/ponyb/gate.php

debtsmartretirement.com/ponyb/gate.php

50.63.222.182/GGBG2H.exe

Malicious File Name and MD5:

FAX_[removed].zip (3B62C05F246955CE6E4696CC804F59C7)

FAX_[removed].exe (b41042e5403cf6bbf3bfecd2c12cf32c)

ofqyar.exe (03cab5a930b8ddd6dcead669e9450172)

[threattrack]

Malicious America Expres Secure Message Spam

Subjects Seen:

Confidential - Secure Message from AMEX

Typical e-mail details:

The security of your personal information is of the utmost importance to American Express, so we have sent the attached as a secure electronic file. Note: The attached file contains encrypted data. If you have any questions, please call us at 800-483-2812, option 6. Representatives are available to assist you Monday through Thursday between 8:00 a.m. and 8:00 p.m. ET and Friday between 8:00 a.m. and 6:00 p.m. ET. The information contained in this message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Thank you, American Express

Malicious URLs

hollywood-hills-condos.com/ponyb/gate.php

hancock-park-real-estate-listings.com/ponyb/gate.php

mail.yaklasim.com:8080/ponyb/gate.php

serw.myroitracking.com/vHn3xjt.exe

pro-sb-immobilien.de/stdwR8gb.exe

pro-sb-immobilien.de/V2S8tCBi.exe

Additional Notes:

None at this time.

[threattrack]

Malicious Bank of America Bill Payment Alert Spam

Subjects Seen:

Unable to process your most recent Bill Payment

Typical e-mail details:

You have a new e-Message from Bank of America This e-mail has been sent to you to inform you that we were unable to process your most recent payment of bill. Please check attached file for more detailed information on this transaction.

Malicious URLs

64.34.70.32:8080/ponyb/gate.php

ns.ntconseil.com/FAyMXA.exe

photolaboratorio85.it/GXxiN.exe

kpcmiami.org/zk9s.exe

Additional Notes:

None at this time.

[threattrack]

DHL Notification Spam

Subjects seen:

DHL delivery report [removed]

Typical e-mail details:

 DHL notification Our company’s courier couldn’t make the delivery of parcel. REASON: Postal code contains an error. LOCATION OF YOUR PARCEL: New York DELIVERY STATUS: sort order SERVICE: One-day Shipping NUMBER OF YOUR PARCEL: ETBAKPRSU3 FEATURES: No Label is enclosed to the letter. Print a label and show it at your post office. An additional information: If the parcel isn’t received within 15 working days our company will have the right to claim compensation from you for it’s keeping in the amount of $8.26 for each day of keeping of it. You can find the information about the procedure and conditions of parcels keeping in the nearest office. Thank you for using our services. DHL Global

Malicious URLs

seantit.ru/power/c1.php

mindcrackers.com/templates/beez/p26c.exe

Additional Notes:

None at this time.

[threattrack]

Federal Reserve FedMail ACH Advise Spam

Subjects seen:

FedMail (R): Federal ACH Advice - End of Day - 03/4/13

Typical e-mail details:

Please overview attached ACH Notification Record from the Federal Reserve Banking System

Malicious URLs

airfours.com/jU3h3.exe

paulgormanonline.com/zHhc.exe

109.228.14.232/rDK3wN2.exe

Additional Notes:

None at this time.

[threattrack]

IRS Transaction Canceled Spam

Subjects seen:

Your transaction is not accepted

IRS report of not accepted tax transfer

Income Tax Refund REJECTED

Typical e-mail details:

Your State Tax remittance (ID: [removed]), recently initiated from your checking account was returned by Internal Revenue Service payment processing unit.

Internal Revemue Service

Malicious URLs

naventis.com/blog//wp-content/themes/mantra/uploads/irs_rjtd.html

jordyhilbink.com//wp-content/themes/mantra/uploads/irs_rjtra.html

micropowerboating.net/detects/pending_details.php

Additional Notes:

None at this time.