Monday, 9 March 2015

You have received a voice mail Microsoft Outlook

You have received a voice mail Microsoft Outlook. attachment being spammed containing a zip file

These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.
Note
It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net.

It's not advised to ring them as there won't really be anything they can do to help you.

Message Header:
From: "Microsoft Outlook" {no-reply@
Subject: You have received a voice mail.
Message Body:
You received a voice mail : VOICE485-494-3573.wav (28 KB)
Caller--Id: 485-494-3573
Message--Id: 0LXDXQ
Email--Id: billj@

Download and extract to listen the message.

We have uploaded voicemail report.
Please use the following link to download your file:
---
Download voice mail
---


Microsoft Exchange Server
Link takes you to:
http://junubsudansports.org/yph78u/1t662.html


Link takes you to:
http://junubsudansports.org/yph78u/1t662.html

The above site downloads a zip file:
http://ifreedumb.com/webservice/VOICE8411-253-481.zip

Inside the Zip file is a Windows Executable:
VOICE8411-253-481


Sha256 Hashes:
a8aceed50338d28f9df712bfb9eacd49453de1a2ba86e268d00bda95305e2ae4 [1]

Malware Macro document information:
VirusTotal Report [1] (hits 2/57 Virus Scanners)

Malwr Report [1]

Hybrid Analysis Report [1]
Cheers,
Steve

No comments: