Description
Cisco Security Intelligence Operations has detected significant activity related to spam e-mail messages that claim to contain an airline ticket purchase notification for the recipient. The text in the e-mail message attempts to convince the recipient to open the link to download and print the ticket. However, the link contains a .zip file containing a malicious .scr file that, when executed, attempts to infect the system with malicious code.
E-mail messages that are related to this threat (RuleID5326 and RuleID5326KVR) may contain the following files:
pdf_canair_ticket.zip
pdf_canair_ticket.scr
pdf_delta_ticket.zip
pdf_delta_ticket.scr
The pdf_canair_ticket.scr file in the pdf_canair_ticket.zip archive has a file size of 267,623 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0xACDB9B18ADBC957FF3691999636EAAEB
The pdf_delta_ticket.scr file in the pdf_delta_ticket.zip attachment has a file size of 291,840 bytes. The MD5 checksum is the following string: 0xF66358BF351E6038B9A75B2F0F01860D
The following text is a sample of the e-mail message that is associated with this threat outbreak:
Subject: Your Order#63916372 - APPROVED
Message Body:
Dear Customer,
Your credit card has been successfully processed.
FLIGHT NUMBER ET62082CA
ELECTRONIC 63916372
DATE & TIME / FEB 19, 2013, 10:22 AM
ARRIVING / TORONTO
TOTAL PRICE / CAD 419.33
Please download and print your ticket from the following URL : hxxps://aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=63916372&acton=download&fid=ET62082CA
For more information regarding your order, contact us by visiting : hxxp://www.aircanada.com/en/customercare/index.html
Thank you
America Airlines.
Or
Subject: Your Order#628190172 - APPROVED
Message Body:
Dear Customer,
Your credit card has been successfully processed.
FLIGHT NUMBER DT628190172US
ELECTRONIC 628190172
DATE & TIME / FEB 19, 2013, 12:45 AM
ARRIVING / Washington
TOTAL PRICE / 429.33 USD
Please download and print your ticket from the following URL :
hxxps://www.delta.com/flifo/servlet/DeltaDLTicket?airline_code=DL&flight_number=DT628190172US&flight_date=02/18/2013&request=main
For more information regarding your order, contact us by visiting :
hxxps://www.delta.com/content/www/en_US/support/talk-to-us.html
Thank you
Delta Airlines.
Source: Cisco