Date: Mon, 10 Dec 2012 06:01:01 -0500
From: “Octavio BOWMAN” [[email protected]]
Subject: You have been sent a file (Filename: [redacted]-722.pdf)
Sendspace File Delivery Notification:
You’ve got a file called [redacted]-018.pdf, (767.2 KB) waiting to be downloaded at sendspace.(It was sent by Octavio BOWMAN).
You can use the following link to retrieve your file:
The file may be available for a limited time only.
sendspace – The best free file sharing service.
Please do not reply to this email. This auto-mailbox is not monitored and you will not receive a response.
The malicious payload is at [donotclick]anifkailood.ru:8080/forum/links/column.php hosted on the following IPs:
126.96.36.199 (GNet, Mongolia)
188.8.131.52 (Secure Netz, Germany)
184.108.40.206 (Secure Netz, Germany)
Leave a reply