Tuesday, 31 March 2015

Saleem Nadapuram INVOICE

Saleem Nadapuram INVOICE email with an  Ace attachment...

Headers:
Subject: Fwd: INVOICE
From: Saleem Nadapuram {nadapurams@gmail.com}
Message body:
Good Day Sir

Please find attach copy of invoice we receive from you, and reconfirm
to us before we proceed with the payment

Best Regards
Mr.Saleem

There's a Ace file attached to the email:
INVOICE...ace

What on earth is Ace ? Here comes a bit of retro....
ACE is a proprietary data compression archive file format developed by Marcel Lemke.  It was very popular around 1999–2001, which at the time provided slightly better compression than RAR.   So, it's certainly a blast from the past ! 

Inside the Ace file is a Windows Executable file:
INVOICE..exex
Sha256 Hash:
5f20238b7d7684b10df695ae3ee56dd1e656e692fcdda30255c218f81d7bda39  [1]

Malware Anti-Virus Reports:
VirusTotal Report [1] (hits 26/57 Virus Scanners)
Malwr Report [1]
Hybrid Analysis Report [1]

Cheers,
Steve
Sanesecurity.com

No comments: