Another fake “HP scan” document with a malicious attachment.
Date: Fri, 16 Mar 2012 10:49:18 -0300
From: scan@victimdomain.com
Subject: Fwd: Scan from a Hewlett-Packard ScanJet 684248
Attachments: HP_Document-16-539.htmAttached document was scanned and sent
to you using a Hewlett-Packard Scan Jet 57968D.
SENT BY: KAM
PAGES : 4
FILETYPE: .HTML [Internet Explorer File]
The payload is on debiudlasduisioa.ru:8080/images/aublbzdni.php – the IPs are the same as in this spam run and should be blocked if you can do it.
Leave a reply
