Monday, 18 June 2007

Greeting card

Received a whole load of these "greeting cards" this morning:
















The fake site you visit has some "re-direct" code:










If you do actually go to the site, it'll look something like this, followed by an auto-download of
the "flash-player" needed:















Submitting the exe file to VirusTotal reveals, surprise surprise... it's not a flash-player:














The email is currently being detected as: Email.Malware.Sanesecurity.07061801

No comments: