Not sure what this is .......

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Jul 22, 2008 9:25 pm

This email came with a .zip file attached. I have not opened the file as I assume doing so might be unsafe.

Does anyone know if this is a scam, or a deliberate virus/trojan infection being sent.

I have not dealt with UPS and the tracking number supplied is not valid.

Quote:

Tue, 22 Jul 2008 04:06:53 -0700
Received: from [195.149.222.42] by mail.aquanovapoolnspa.com; Tue, 22 Jul 2008 12:06:54 +0100
From: "United Parcel Service" <[email protected]>
To: <[email protected]>
Subject: UPS Tracking Number 9121558584
Date: Tue, 22 Jul 2008 12:06:54 +0100
Message-ID: <01c8ebf3$6e4a4300$2ade95c3@ter4>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_000E_01C8EBF3.6E4A4300"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0
Importance: Normal
Return-Path: [email protected]
X-OriginalArrivalTime: 22 Jul 2008 11:06:54.0980 (UTC) FILETIME=[0D1B6440:01C8EBEB]

Unfortunately we were not able to deliver postal package you sent on July the 1st in time because the recipient's address is not correct.
Please print out the invoice copy attached and collect the package at our office

Your UPS

Elite Baiter Joined: 19 Jan 2008 Posts: 1043

Seems pretty sloppy for a infection attempt. Usually the one's that are any good with malware can also spoof an actual UPS sounding email.

It will probably just turn into a trunkbox-esque type scam where you will have to pay for taxes. charges etc.

the attachment is probably just a word doc with some info on probably saying that the parcel contains 12 laptops or something else to make you want it. I guess it is the scammer version of the ASEM.

Oh, the IP is Vienna, Austria.

Posted: Wed Jul 23, 2008 1:26 am

It's a zip file, which screams virus. My nonprofit got this yesterday and I wanted to see what was going around and I did a little checking. The attached botnet itself has been around a while so if you did open it, chances are your AV is already able to address it. Here's one of the stories.

HUGE LONG PAGE_BLOWING URL

Posted: Wed Jul 23, 2008 3:58 am

@falnsb - forward it to me if you like and I'll check it out. I have a computer set up just for this purpose. Very Happy

Posted: Wed Jul 23, 2008 4:21 am

100% nasty.

From Dorothy's link.

Quote:

Malicious spammers have used fake United Parcel Service (UPS) invoices to distribute malware as part of the latest social engineering ploy to fool unsuspecting recipients into downloading malicious components from the Web. The new ploy, used in malicious spam emails coming from the Pushdo botnet, claims to be from UPS and asks recipients to print out a fictitious invoice to claim a package that could not be delivered.

The message includes a ZIP file attachment called 'ups_invoice.zip'. the Pushdo botnet often uses ZIP archive files as attachments to try to hide malicious executable files from automatic email filters. The file inside the ZIP is called 'ups_invoice.exe' but displays a Microsoft Word icon in an attempt to make it appear like a harmless Word document.

Posted: Wed Jul 23, 2008 6:17 am

@sheboppe

I deleted it yesterday as I didn't want it lurking around, but thanks for the kind offer.

Anyway it now appears from the subsequent posting that it was indeed a malware attempt so thanks to all of you for the information. I just relied in this case on my intuition as I might have otherwise opened it out of curiousity to see what it was.

Posted: Wed Jul 23, 2008 8:57 am

I got three copies yesterday which I promptly deleted. Send out millions of them and some people will fall for it. Just like some do for 419 scams.

Posted: Wed Jul 23, 2008 5:39 pm

@falnsb - you're welcome. The subsequent posting cleared it up for me too. Very Happy

Posted: Thu Jul 24, 2008 12:18 am

Oops, sorry about the length of the URL...

Not sure what this is .......	View next topic View previous topic