Headers:
Message body:
From: "Alpro" {carmel@alpro.com}
Subject: Alpro Invoice(s): 7985974765
Please see attached for your invoice(s) with the following invoice
number(s): 7985974765.
Kindest Regards,
Carmel Wilson
Alpro Customer Care
Tel: 0800 0 188 180
www.alpro.com/uk [1]
www.facebook.com/alpro [2]
www.twitter.com/Alpro_UK [3]
If you want to hear more about Alpro, our products and competitions,
click here [4] to sign up to our newsletter
There's a Zip file attached to the email:
invoice7985974765.zip
Inside the Zip file is a Windows executable:
Sha256 Hashes:
invoice7985974765.exe
6c69e4579d565906827983246c93ed0d43f408326a1e3fac351a4730226424f2 [1]
Malware Information:
VirusTotal Report [1] (hits 4/57 Virus Scanners)
Malwr Report [1]
Hybrid Analysis Report [1]
Cheers,
Steve
Sanesecurity.com
17 comments:
Just got one of these. Thanks for posting about it.
Thanks for this!
same I just got one thank you
Do people open invoice?
I do not, because I Do NOT
want to pay anything
but I am a Gypsy
THANK YOU FOR YOUR HELP
Got the “Alpro Invoice(s): 7985974765” email this morning, which is funny, because I do not do business with Alpro. As soon as I saw the ZIP file, I knew it was dangerous. I googled “Alpro Invoice”, and the Sanesecurity Blog was 2nd from the top. Thanks for confirming my suspicions.
Thanks, I got the same email, is Carmel Wilson's computer compromised?
Cheers
Daniel
Just got one, too. Thanks for posting.
Received one as well, these are popping up a lot the last few weeks, from various "vender"
stating an invoice is attached.
I got one just now. Google-ed and found this site. Awesome job in posting this!
Got this to my work email. I have never heard of Alpro. Googled it and it looked like a legitimate company, but googled for scam and found this. Thank you.
Also just got this email. Thanks for posting!
Thank you for posting. These scams keep getting better and I'm thankful I have this source to help verify what junk lies in my email.
Got this email also. Was very suspicious about it, so I Googled it and found this.
Thank you for posting.
Thanks for sharing, just got one like this.
Thanks for sharing, just got one like this.
Yep, looks like they're still sending it as I received one too.
Thanks for sharing.
Post a Comment