Description
Cisco Security Intelligence Operations has detected significant activity related to spam e-mail messages that claim to contain a fax report notification for the recipient. The text in the e-mail message attempts to persuade the recipient to open the attachment and view the details. However, the attachment contains a malicious .exe file that, when executed, attempts to infect the system with malicious code.
E-mail messages that are related to this threat (RuleID5052) may contain the following files:
Cost sheet for the second half of 2012
Cost sheet for the second half of 2012.pdf.exe
The Cost sheet for the second half of 2012.pdf.exe file size in the Cost sheet for the second half of 2012 attachment is unavailable. The MD5 checksum is also unavailable.
The following text is a sample of the e-mail message that is associated with this threat outbreak:
Subject: INCOMING FAX REPORT : Remote ID: 434-398-3989
Message Body:
*********************************************************
INCOMING FAX REPORT
*********************************************************
Date/Time: 1/11/2013 01:24:12 EST
Speed: 95376 bps
Connection time: 01:06
Pages: 1
Resolution: Normal
Remote ID: 434-398-3989
Line number: 434-398-3989
DTMF/DID:
Description: ?ost sheet for the second half of 2012
*********************************************************
Source: Cisco