It’s been a busy 48 hours for the e-mail virus ruffians. I suspect with Mother’s Day approaching it will only get worse. Keep an eye out for fake Mother’s Day e-cards and the like. The following examples were all received in the last 48 hours.
The first one I have a feeling might trick a few people. It claims to be from the iTunes Store..
From: iTunes Store [certificate@itunes.com]
Subject: Thank you for buying iTunes Gift Certificate!Hello!
You have received an iTunes Gift Certificate in the amount of $50.00 You can find your certificate code in attachment below.
Then you need to open iTunes. Once you verify your account, $50.00 will be credited to your account, so you can start buying music, games, video right away.
iTunes Store.
The payload is in the attachment iTunes_certificate_497.zip which contains the file iTunes_certificate_497.exe
ESET NOD32 identifies this as Win32/Oficla.GT trojan
Next up, are 3 variations of the, we missed you and couldn’t deliver something scam.
From: DHL Support Kimberly Parsons [delivery@dhl-usa.com]
Subject: DHL delivery problem Nr22755.Hello!
We were not able to deliver the postal package sent on the 8th of March in time because the addressee’s address is not correct.
Please print out the invoice copy attached and collect the package at our department.DHL Customer Services.
From: DHL Manager Javier Stratton [courier@dhl-usa.com]
Subject: DHL delivery problem Nr00684.Dear customer!
We were not able to deliver the postal package which was sent on the 21st of February in time because the addressee’s address is wrong.
Please print out the invoice copy attached and collect the package at our office.DHL Express Services.
From: Service Manager Chandra Morales [manager@ups.com]
Subject: UPS Delivery Problem NR 52979.Dear customer!
We failed to deliver postal package which was sent on the 15th of February in time because the recipient’s address is erroneous.
Please print out the invoice copy attached and collect the package at our department.DHL Customer Services.
The attachments for these were:
DHL_invoice_6817.zip which is Win32/Oficla.GQ trojan
DHL_invoice_2817.zip which also is Win32/Oficla.GQ trojan
UPS_invoice_5978.zip – which is a variant of Win32/Injector.BNG trojan
Remember to keep an eye out for fake Mother’s day scams too.
