April 09, 2010More Faux-Amazon Malware Delivery
I really hate seeing these because they will trick lots of unsuspecting users into opening the malware-laden attachments:
From: "Amazon Support Lilia Ruiz" <firstname.lastname@example.org>
Subject: Your order has been paid! Parcel NR.2086.
Thank you for shopping at Amazon.com
We have successfully received your payment.
Your order has been shipped to your billing address.
You have ordered " Apple Refurbished MacBook Pro "
You can find your tracking number in attached to the e-mail document.
Print the postal label to get your package.
We hope you enjoy your order!
The attachment on the sample I saw is named Print_label_2387.zip. In the past, the attachment name has been variable from message to message, as is the item being ordered (various computer or other electronics items).
Even more unfortunately, the attachment fares very poorly at this hour in a VirusTotal scan: only 10% coverage. Yikes!Posted on April 09, 2010 at 09:56 AM