Greeting card

Received a whole load of these "greeting cards" this morning:
















The fake site you visit has some "re-direct" code:










If you do actually go to the site, it'll look something like this, followed by an auto-download of
the "flash-player" needed:















Submitting the exe file to VirusTotal reveals, surprise surprise... it's not a flash-player:














The email is currently being detected as: Email.Malware.Sanesecurity.07061801

Free Video malware

Received a few copies of this email this morning, which as you can see, is asking to click on a link to download an exe file:















As you can see from the source code, they've tried to hide the contents by encoding the email with base64:








Submitting the exe file to VirusTotal, gives us this worrying picture:













Hopefully, now it's been submitted to VirusTotal, more AV's will add detection.

rtf malware spam

This seems to be a new formatted malware spam going around, along the same lines as the "Better Business Bureau targeted malware spam" that SANS reported today.

Here's a screenshot from the new style spam:















If you go to the top level directory of the domain that's hosting the file, you can see an open directory:
















What's interesting is the date of the actual "bad" RTF file, 9th May 2007... so as it's been there a while now, let see how the Anti-Virus scanners coped:

Complete scanning result of "superpages.rtf", received in VirusTotal at 05.26.2007, 08:23:20 (CET).

AhnLab-V3 2007.5.24.0 05.25.2007 no virus found
AntiVir 7.4.0.27 05.25.2007 no virus found
Authentium 4.93.8 05.23.2007 Possibly a new variant of W32/CrazyCrunch-based!Maximus
Avast 4.7.997.0 05.25.2007 no virus found
AVG 7.5.0.467 05.25.2007 no virus found
BitDefender 7.2 05.26.2007 Trojan.Spy.Agent.NDQ
CAT-QuickHeal 9.00 05.25.2007 no virus found
ClamAV devel-20070416 05.25.2007 no virus found
DrWeb 4.33 05.25.2007 no virus found
eSafe 7.0.15.0 05.24.2007 no virus found
eTrust-Vet 30.7.3665 05.26.2007 no virus found
Ewido 4.0 05.25.2007 no virus found
FileAdvisor 1 05.26.2007 no virus found
Fortinet 2.85.0.0 05.26.2007 no virus found
F-Prot 4.3.2.48 05.25.2007 W32/CrazyCrunch-based!Maximus
Ikarus T3.1.1.8 05.26.2007 no virus found
Kaspersky 4.0.2.24 05.26.2007 Trojan-Spy.Win32.Delf.jq
McAfee 5039 05.25.2007 no virus found
Microsoft 1.2503 05.26.2007 TrojanSpy:Win32/Logsnif.gen
NOD32v2 2292 05.25.2007 no virus found
Norman 5.80.02 05.25.2007 no virus found
Panda 9.0.0.4 05.25.2007 Trj/Passtealer.DE
Prevx1 V2 05.26.2007 no virus found
Sophos 4.18.0 05.25.2007 Troj/Agent-FPG
Sunbelt 2.2.907.0 05.26.2007 no virus found
Symantec 10 05.26.2007 no virus found
TheHacker 6.1.6.123 05.25.2007 no virus found
VBA32 3.12.0 05.26.2007 suspected of Malware.Delf.43
VirusBuster 4.3.23:9 05.25.2007 no virus found
Webwasher-Gateway 6.0.1 05.26.2007 Trojan.Spy.Delf.JQ.112 (suspicious)

Aditional Information
File size: 157686 bytes
MD5: d948f4b41be0aee7b3bd292e33082313
SHA1: 5e4f9655effbcb7ff8f03f05a6a4f778bf9a54f6
packers: UPX
packers: UPX, BINARYRES, UPX
packers: UPX

Hopefully this will improve now that VirusTotal have the file. Until then... I've added a simple detection for this new type: Html.Malware.Sanesecurity.07052600

OpenDNS

OpenDNS.... maybe you've heard of it... but it's so easy to setup... and free... try it :)

OpenDNS replaces your ISP's dns servers... but with one important improvement... OpenDNS will warn you if a site or link you have just clicked on... is a known phishing site!

Use it as a backup to the normal FireFox/IE phishing toolbar plugins.

More info here

Another mailto eBay phish

Here's a genuine looking eBay phishing attempt that came in today. As you can see all the links point back to the genuine eBay site:















It's only when you view the source code that you notice that something doesn't seem right with this email. You can see that if you did try and login to eBay directly from this email, your eBay login details would be kindly sent to seflab...@yahoo.com via the mailto server mailhost.dglnet.com.br:




So, lets take a look at mailhost.dglnet.com.br. Well, looks like they are running squirrelmail but let's checkout the version number.... hmmm... v1.4.4:









Let's go to the main squirrelmail site and see what version is the current one. Well, the latest one is:

SquirrelMail 1.4.10a Released
May 09, 2007 by Thijs Kinkhorst

The SquirrelMail Project Team is proud to announce the release of SquirrelMail 1.4.10a. The 1.4.10 release contains multiple fixes for cross site scripting issues triggered by viewing HTML mail. Besides that it contains bug fixes and stability enhancements

The version before that looks something like this changelog wise:













Are the any problems with running older versions... yep... just a few!

So, looks like keeping webmail software up to date is a must.