Lucene search

CiscoCISCO-THREAT-25325

HistoryMar 06, 2012 - 6:23 p.m.

Threat Outbreak Alert: Fake Xerox Scan Attachment Email Messages on May 6, 2015

2012-03-0618:23:33

Cisco

tools.cisco.com

148

JSON

Medium

Alert ID:

25325

First Published:

2012 March 6 18:23 GMT

Last Updated:

2015 May 6 12:23 GMT

Version:

Summary

Cisco Security has detected significant activity related to spam email messages that claim to contain a scanned document from a Xerox WorkCentre Pro device. The text in the email message attempts to convince the recipient to open the attachment and view the document. However, the attachment could contain a malicious .exe or .htm file that, when executed, attempts to infect the system with malicious code.

Email messages that are related to this threat (RuleID3990, RuleID3990KVR, RuleID4274, RuleID4274KVR, and RuleID4274_1KVR) may contain any of the following files:

> Xerox_Doc-W202.htm
Xerox_Scan_03.10_QZ37927.htm
Xerox_Document_03.09_5Z1123.htm
Xerox_Document-2513.zip
Xerox_Scan_NB328345.exe
Xerox_Scan-V80.zip
Xerox_Scan_ID99923523.exe
product sample.zip
product sample.exe
product(1).zip
product.exe
product samples.zip
product samples.exe
purchase order.zip
tt.pdf.exe
d12-.exe
Order.zip
Order.exe
quote.rar.exe
payment slip.zip
payment slip_xls.exe
PPURCHASE-ORDER-.zip
PURCHASE-ORDER-.exe
order listCatalogue.Jpeg.zip
PURCHASE ORDER PDF PDF.exe
ORDER.zip
ready.exe
ORDER-SAMPLE2-.zip
ORDER-SAMPLE2-.exe
New Order.zip
New Order.exe
xju3_wyb20-2012241019-7128487514-63_pdf.zip
inbound.fax.PDF.viewer.exe
FAX_20120711_0414157531_7.pdf.zip
Purchase Order.exe
bbb.complaint.report.id62502413.pdf.zip
PAYMEN~1.EXE
paymentslip.zip
payment slip.exe
Purhcase Order.zip
Purchase Order #436.exe
Profile.exe
Sample.pdf.zip
product sample.zip.zip
paymentslip?fdp.exe
telexrat.exe
PURCHASE ORDER.zip
TT Copy.exe
Purchase #042.exe
New_Quotation_Order.zip
New_Quotation_Order.EXE
paymentslip.exe
Order Sample10-.zip
Order Sample10-.exee
SAMPLE_ORDER.zip
SAMPLE_ORDER.DOCX.exe
Confirm payment slip.zip
New order.exe
sample (1).zip
sample.exe
Payment Advice [B43285147134].zip
_Payment Advice [B43{hsbs ref}].exe
Sample.zip
PAYMENT RECEIPT 24-04-2013-GBK-75.zip
PAYMENT RECEIPT 24-04-2013-GBK-75.exe
Purchase Order.zip
New Ans.scr
Payment receipt.exe
Payment slip.scr
Product Sample.zip
Product Sample.exe
PAYMENT RECEIPT 30-04-2013-GBK-75.zip
Payment reeceipt.exe
Payment_Invoice DOR-2013004001M-PI_RLB 9.4.2013.zip
Payment_Invoice DOR-2013004001M-PI_RLB 9.4.2013.exe
payment.zip
_payment.exe _
MT103 OF $45,000 USD.zip
productsample.exe
Quotation.zip
Bank payment slip.exe
Payment Advice [B45430295471].zip
_Payment Advice [B45{hsbs ref}].exe
PO Samples.zip
Product Samples.scr
PURCHASE ORDER 3025.zip
New Godwin.scr
Payment Advice [G52766575985].zip
_Payment Advice [G52{net1}].exe
Sample_and_Purchase#45890-00.zip
Purchase Order.scr
Bank Payment Slip.zip
Payment Advice [G54058750905].zip
_Payment Advice [G54{net1}].exe
Payment_Advice.zip
Payment Advice [G52094179903].zip
Payment_Advice.exe
Payment.zip
Payment.scr
paymentSlip.scr
Payment Copy For New Invoice.zip
Payment Copy For New Invoice.scr
Purchase Order No. 693.zip
Purchase Order No. 693.exe
Payment Advice [G55526943723].zip
Payment Advice.exe
Catalogue.zip
Order.scr
12 Containers Order.zip
Bank payment slip.exe
products.zip
Product.scr
Product.zip
Defected-Products_1.zip
Defected-Products.exe
Company_Profile_Order.zip
Company_Profile_Order.exe
PAYMENT DETAILSS.zip
products.exe
order SING13060023.zip
order-SING13060023.exe
Payment Advice [G59457060380].zip
_Payment Advice [G59{net1}].exe
Sample Order.zip
Sample Order.exe
Payment Advice [G59565891791].zip
Payment Advice [G60560870754].zip
_Payment Advice [G60{_net1}].exe
Payment Advice [G61888652341].zip
Payment Advice [G61{_net1}].exe
Purchase order.zip
Purchase order.scr
DHL_Tracking details.zip
DHL_Tracking details.exe
_

The Xerox_Doc-W202.htm has a file size of approximately 2,328 bytes. The MD5 checksum is not available.

The Xerox_Scan_03.10_QZ37927.htm has a file size of approximately 3,153 bytes. The MD5 checksum is not available.

The Xerox_Document_03.09_5Z1123.htm has a file size of approximately 3,112 bytes. The MD5 checksum is not available.

The Xerox_Scan_NB328345.exe file in the Xerox_Document-2513.zip attachment has a file size of 99,840 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0xAB1A8D2D4DB3DA2EE7C0D3F38BCFFFED

The Xerox_Scan_ID99923523.exe file in the Xerox_Scan-V80.zip attachment has a file size of 97,792 bytes. The MD5 checksum is the following string: 0x1AE5F11C5520CFE6DC66F5116A8DF80E

The product sample.exe file in the product sample.zip attachment has a file size of 201,216 bytes. The MD5 checksum is the following string: 0x419C3D9B79E4E207EA6E35894433D9C4

The product.exe file in the product(1).zip attachment has a file size of 277,134 bytes. The MD5 checksum is the following string: 0xCB3926522AF78234A4BEBADCDF3E9238

The product samples.exe file in the product samples.zip attachment has a file size of 159,446 bytes. The MD5 checksum is the following string: 0xB1B9D817FD1A3C8E4EFD52016A5E7A3

A variant of the product sample.exe file in the product sample.zip attachment has a file size of 209,408 bytes. The MD5 checksum is the following string: 0x30A2E8BCD50A645AEB4E05A71B1DEA72

The d12-.exe file in the purchase order.zip attachment has a file size of 205,312 bytes. The MD5 checksum is the following string: 0xF761A04DA6B5E11FE3CD59B901C10185

The quote.rar.exe file in the Order.zip attachment has a file size of 575,113 bytes. The MD5 checksum is the following string: 0x97A3DF83E0EA9122462EC22B1B012857

The payment slip_xls.exe file in the payment slip.zip attachment has a file size of 1,012,165 bytes. The MD5 checksum is the following string: 0x4D0324BC132EE1B5ED757543152AD632

The PURCHASE-ORDER-.exe file in the PPURCHASE-ORDER-.zip attachment has a file size of 266,752 bytes. The MD5 checksum is the following string: 0xE52F1216908B55F6329E03254970B96F

The PURCHASE ORDER PDF PDF.exe file in the order listCatalogue.Jpeg.zip attachment has a file size of 702,752 bytes. The MD5 checksum is the following string: 0x0C44E34D4EB0CBDB195BCA7DC8494014

The ready.exe file in the ORDER.zip attachment has a file size of 454,718 bytes. The MD5 checksum is the following string: 0x017FBF1A2D0CD9F3A31FC72095AC0373

The ORDER-SAMPLE2-.exe file in the ORDER-SAMPLE2-.zip attachment has a file size of 258,560 bytes. The MD5 checksum is the following string: 0x7DDB480F1D80FE536A52DCD444584B50

A variant of the PURCHASE ORDER PDF PDF.exe file in the PURCHASE ORDER.zip attachment has a file size of 728,864 bytes. The MD5 checksum is the following string: 0x351E904C8AC9D0293FB0FBFC918638AF

The New Order.exe file size and MD5 checksum are not available.

The inbound.fax.PDF.viewer.exe file in the xju3_wyb20-2012241019-7128487514-63_pdf.zip attachment has a file size of 126,823 bytes. The MD5 checksum is the following string: 0xF514109B244596A3E37779E3112D8138

The Purchase Order.exe file has a file size of 575,088 bytes. The MD5 checksum is the following string: 0x3E5D3D7304D36662311301B5F3EE5D7A

A variant of the inbound.fax.PDF.viewer.exe file in the bbb.complaint.report.id62502413.pdf.zip attachment has a file size of 120,320 bytes. The MD5 checksum is the following string: 0xA2288305295D8245FA2FD93B20E9F116

A third variant of the inbound.fax.PDF.viewer.exe file in the FAX_20120711_0414157531_7.pdf.zip attachment has a file size of 137,072 bytes. The MD5 checksum is the following string: 0x7FEDD29DC94B3FE6ABC6BC5EF5D6934F

The tt.pdf.exe file in the Purchase Order.zip attachment has a file size of 575,047 bytes. The MD5 checksum is the following string: 0x6F2A1B2D767E5F7BADB8C2F95074361F

The PAYMEN~1.EXE file in the paymentslip.zip attachment has a file size of 605,696 bytes. The MD5 checksum is the following string: 0xD105CE7D6DBA0763A8EBF01AE52429F1

The payment slip.exe file in the payment slip.zip attachment has a file size of 1,314,566 bytes. The MD5 checksum is the following string: 0x1E8956C1A50369FBFB2273C4603820ED

The Purchase Order #436.exe file in the Purhcase Order.zip attachment has a file size of 108,227 bytes. The MD5 checksum is the following string: 0x38102E24C5C8738B9EE41CDEB756A017

The Profile.exe file in the Purhcase Order.zip attachment has a file size of 343,552 bytes. The MD5 checksum is the following string: 0xB36B1A88E5DE7A81FA1A97430094086A

The Sample.exe file in the Sample.pdf.zip attachment has a file size of 238,020 bytes. The MD5 checksum is the following string: 0xF8CB6E81C21DEE8326FBE9A709186F91

The product.exe file in the product sample.zip.zip attachment has a file size of 178,506 bytes. The MD5 checksum is the following string: 0x3271E0BEA672ECAEB7FEBB4643049270

The paymentslip?fdp.exe file in the paymentslip.zip attachment has a file size of 520,704 bytes. The MD5 checksum is the following string: 0x63F23BF40CF1801BD91963A740AE4571

The Order.exe file in the Order.zip attachment has a file size of 242,176 bytes. The MD5 checksum is the following string: 0xDF19248558103C8B998D1B13512289EC

The telexrat.exe file in the payment slip.zip attachment has a file size of 1,000,460 bytes. The MD5 checksum is the following string: 0xBFD24F223EA8AF2210DC980DDF8D2A3E

The TT Copy.exe file in the PURCHASE ORDER.zip attachment has a file size of 186,368 bytes. The MD5 checksum is the following string: 0x520C6484874BC7DFD6C989A51CD8BF84

The Purchase #042.exe file in the Purchase Order.zip attachment has a file size of 435,200 bytes. The MD5 checksum is the following string: 0x8466BE93AEF72616A070D719D075FE75

The New_Quotation_Order.EXE file in the New_Quotation_Order.zip attachment has a file size of 195,072 bytes. The MD5 checksum is the following string: 0x9DAA47EF691B5D8DBABF85351A1C30A6

The paymentslip.exe file in the paymentslip.zip attachment has a file size of 602,112 bytes. The MD5 checksum is the following string: 0x6BB0B0306D2A4E80CA60137738262AC1

The Order Sample10-.exee file in the Order Sample10-.zip attachment has a file size of 229,888 bytes. The MD5 checksum is the following string: 0xDE0E60DF038CAC76FAC809EB9B18B8F0

The SAMPLE_ORDER.DOCX.exe file in the SAMPLE_ORDER.zip attachment has a file size of 3,656,942 bytes. The MD5 checksum is the following string: 0xEAFF80DAE84C074F5F9EF47BDA174075

The New order.exe file in the Confirm payment slip.zip attachment has a file size of 250,368 bytes. The MD5 checksum is the following string: 0xA1B0F984EE84CF7BB7B09C3C56AAB3D2

A variant of the Purchase Order.exe file in the Purchase Order.zip attachment has a file size of 694,681 bytes. The MD5 checksum is the following string: 0xFF89B337CA41C41ACBDA78C652755E58

A variant of sample.exe file in the sample (1).zip attachment has a file size of 1,342,229 bytes. The MD5 checksum is the following string: 0x7D09539E3A4FEF74FCD503147BD92C1D

The _Payment Advice [B43{hsbs ref}].exe file in the Payment Advice [B43285147134].zip attachment has a file size of 90,624 bytes. The MD5 checksum is the following string: 0x72D62C853625562765A8701962BF5ADD

A third variant of the Sample.exe file in the Sample.zip attachment has a file size of 804,352 bytes. The MD5 checksum is the following string: 0x4052807C5403C0C9D1561657E53DFCB2

The PAYMENT RECEIPT 24-04-2013-GBK-75.exe file in the PAYMENT RECEIPT 24-04-2013-GBK-75.zip attachment has a file size of 233,472 bytes. The MD5 checksum is the following string: 0xC671D0896A2412B42E1ABAD4BE9D43A8

The New Ans.scr file in the Purchase Order.zip attachment has a file size of 471,552 bytes. The MD5 checksum is the following string: 0x40E35E29B292431ABE9F97B1206B1B48

The Payment receipt.exe file in the PAYMENT RECEIPT 24-04-2013-GBK-75.zip attachment has a file size of 389,632 bytes. The MD5 checksum is the following string: 0xB3D79F187E8896D60623C97BA9C67DD1

The Payment slip.scr file in the Payment slip.zip attachment has a file size of 480,534 bytes. The MD5 checksum is the following string: 0xF84AE52A6B502A2CDE76C4AA5C1C6CBA

The Product Sample.exe file in the Product Sample.zip attachment has a file size of 963,771 bytes. The MD5 checksum is the following string: 0x0CF5208DE7FD7AD4EC8C882DFFAC4888

The Payment reeceipt.exe file in the PAYMENT RECEIPT 30-04-2013-GBK-75.zip attachment has a file size of 371,712 bytes. The MD5 checksum is the following string: 0x0A3723483E06DCF7E51073972B9D1EF3

The Payment_Invoice DOR-2013004001M-PI_RLB 9.4.2013.exe file in the Payment_Invoice DOR-2013004001M-PI_RLB 9.4.2013.zip attachment has a file size of 173,056 bytes. The MD5 checksum is the following string: 0xE76EAD4B30D9C55F40D974ADC7002454

The payment.exe file in the payment.zip attachment has a file size of 528,896 bytes. The MD5 checksum is the following string: 0x05E62E5E63E14D542D689F71347C0620

The productsample.exe file in the MT103 OF $45,000 USD.zip attachment has a file size of 528,896 bytes. The MD5 checksum is the following string: 0x7F005F833F3ACCE59AA75633F35975C6

The third variant of the Purchase Order.exe file in the Purchase Order.zip attachment has a file size of 219,975 bytes. The MD5 checksum is the following string: 0xAECB4ED67F97578573AD12BF7A2F91B7

The Bank payment slip.exe file in the Quotation.zip attachment has a file size of 295,936 bytes. The MD5 checksum is the following string: 0xC6648BB54FAAAB33D65A08DF7DA07A90

A variant of the payment.exe file in the payment.zip attachment has a file size of 568,832 bytes. The MD5 checksum is the following string: 0x660D04A3B3A4ACE7E6DB53BFF59DE786

The _Payment Advice [B45{hsbs ref}].exe file in the Payment Advice [B45430295471].zip attachment has a file size of 133,120 bytes. The MD5 checksum is the following string: 0xB843373B71851B1AD97EA43AA70194EF

The Product Samples.scr file in the PO Samples.zip attachment has a file size of 471,552 bytes. The MD5 checksum is the following string: 0xFCDFD2726C149C17304CBE58F5B77096

The New Godwin.scr file in the PURCHASE ORDER 3025.zip attachment has a file size of 524,800 bytes. The MD5 checksum is the following string: 0x747DEF5627BC741FD82D849451AF69F0

A third variant of the Purchase Order.exe file in the Purchase Order.zip attachment has a file size of 221,105 bytes. The MD5 checksum is the following string: 0xAA449DF6FFD7CD145610D43B590D8DD6

The _Payment Advice [G52{net1}].exe file in the Payment Advice [G52766575985].zip attachment has a file size of 125,952 bytes. The MD5 checksum is the following string: 0x7FF037403087D7DB3CD79F1E73FE5D06

The _Purchase Order.scr _file in the Sample_and_Purchase#45890-00.zip attachment has a file size of 1,370,494 bytes. The MD5 checksum is the following string: 0x02B523F44D71019AD3071665168E04AE

A variant of the Bank Payment Slip.exe file in the Bank Payment Slip.zip attachment has a file size of 229,888 bytes. The MD5 checksum is the following string: 0x268187BCFE4FB9BA2A56D835C1D40A9E

The _Payment Advice [G54{net1}].exe file in the Payment Advice [G54058750905].zip attachment has a file size of 125,952 bytes. The MD5 checksum is the following string: 0x0ABC65C2BE51B33D479C05B10FC10586

The Payment_Advice.exe file in the Payment_Advice.zip attachment has a file size of 127,488 bytes. The MD5 checksum is the following string: 0xE45A4100C0EC53221137F8B546B30198

The Payment.scr file in the Payment.zip attachment has a file size of 387,667 bytes. The MD5 checksum is the following string: 0x951D09E5C41A2E4E8F3EA536EF18C42F

The paymentSlip.scr file in the paymentSlip.zip attachment has a file size of 407,040 bytes. The MD5 checksum is the following string: 0x628F8A2AE36B932253D6AE8888E8FF3F

The Payment Copy For New Invoice.scr file in the Payment Copy For New Invoice.zip attachment has a file size of 549,376 bytes. The MD5 checksum is the following string: 0x42753CD29DB2EDC6EC9BB93BEAB1A17E

The variant of the Payment_Advice.exe file in the Payment Advice [G52094179903].zip attachment has a file size of 84,992 bytes. The MD5 checksum is the following string: 0x6295F7F1FC132C63BCC511146DE12EF5

The Purchase Order No. 693.exe file in the Purchase Order No. 693.zip attachment has a file size of 896,300 bytes. The MD5 checksum is the following string: 0xFDA3DB37A819F2435D4263266D1C4074

The _Payment Advice.exe _file in the Payment Advice [G55526943723].zip attachment has a file size of 78,848 bytes. The MD5 checksum is the following string: 0x6CF4695A367FC0FE976A49A71B1F76F6

The Order.scr file in the Catalogue.zip attachment has a file size of 320,000 bytes. The MD5 checksum is the following string: 0xFCD1667AE77241403D903D1F4B25BE3E

The Bank payment slip.exe file in the 12 Containers Order.zip attachment has a file size of 324,096 bytes. The MD5 checksum is the following string: 0xC9088184746B8AD44DBCC1B2906E9F80

The Product.scr file in the products.zip attachment has a file size of 537,088 bytes. The MD5 checksum is the following string: 0x76C9BBE21F5EFC839B8634826B34F4D1

A variant of the Product.exe file in the Product.zip attachment has a file size of 364,544 bytes. The MD5 checksum is the following string: 0x131E7271C429D7AB158AB061236CE82B

A variant of the Order.exe has a file size of 238,080 bytes. The MD5 checksum is the following string: 0x263F5945D16E542DEACCF7A014A7F03A

A variant of the PAYMENT SLIP.scr has a file size of 368,545 bytes. The MD5 checksum is the following string: 0x2068E511C1CB479FF96D5357B59B21C4

A variant of the purchase order.scr file in the purchase order.zip attachment has a file size of 215,552 bytes. The MD5 checksum is the following string: 0xC23C06BBA9BDD011604508E38472744D

A third variant of the purchase order.scr has a file size of 324,096 bytes. The MD5 checksum is the following string: 0x9F8FD5E567067FFBA03F075C7176B3C3

The Defected-Products.exe file in the Defected-Products_1.zip attachment has a file size of 420,864 bytes. The MD5 checksum is the following string: 0x667A0085A0240914DD656139444A19B7

The Company_Profile_Order.exe file in the Company_Profile_Order.zip attachment has a file size of 446,464 bytes. The MD5 checksum is the following string: 0x2FEDC4B268D4681851969C5C79C4AEB2

A variant of the Bank Payment Slip.exe file in the PAYMENT DETAILSS.zip attachment has a file size of 221,696 bytes. The MD5 checksum is the following string: 0x5B2065E633F68549E2C129BE185CBCF7

The products.exe file in the products.zip attachment has a file size of 745,984 bytes. The MD5 checksum is the following string: 0x96FEA846A244DD533E6214ADCCC8591F

The order-SING13060023.exe file in the order SING13060023.zip attachment has a file size of 188,416 bytes. The MD5 checksum is the following string: 0xD509E7F0377D356469F04843EC89F5D7

The _Payment Advice [G59{net1}].exe file in the Payment Advice [G59457060380].zip attachment has a file size of 120,832 bytes. The MD5 checksum is the following string: 0xD96A60D1232556B6856B41ECDCD8C63A

The Sample Order.exe file in the Sample Order.zip attachment has a file size of 403,456 bytes. The MD5 checksum is the following string: 0xE3F44411301880695121CCDB4FA87559

A variant of the _Payment Advice [G59{net1}].exe file in the Payment Advice [G59565891791].zip attachment has a file size of 87,552 bytes. The MD5 checksum is the following string: 0x71ACA4736F4F32A5E36AE0BBAED99655

The _Payment Advice [G60{net1}].exe file in the Payment Advice [G60560870754].zip attachment has a file size of 96,256 bytes. The MD5 checksum is the following string: 0x8C14F8CB238C60E5B3D2439396350FFA

A variant of the order.exe file size is not available. The MD5 checksum is the following string: 0x841C12D1A2FD2976839D6808BC08B543

The _Payment Advice [G61{net1}].exe file in the Payment Advice [G61888652341].zip attachment has a file size of 115,200 bytes. The MD5 checksum is the following string: 0xC31A479C1A72A2DA86F3CA29180C0E22

A fourth variant of the Purchase order.scr file in the Purchase order.zip attachment has a file size of 233,472 bytes. The MD5 checksum is the following string: 0x716F12914797899E7C580AB5266AC747

A variant of the products.exe file in the products.zip attachment has a file size of 812,032 bytes. The MD5 checksum is the following string: 0xA9F49E70BD9473717137BB978F482A8A

The DHL_Tracking details.exe file in the DHL_Tracking details.zip attachment has a file size of 731,648 bytes. The MD5 checksum is the following string: 0x0AD2DF44F6DC8D01D4896C6A961D8764

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: Scan from a Xerox W. Pro #289906

Message Body:

Please open the attached document. It was scanned and sent
to you using a Xerox WorkCentre Pro.
Sent by: Frederic
Number of Images: 9
Attachment File Type: .HTML [Internet Explorer Format]
Xerox WorkCentre Location: machine location not set
Device Name: XEROX88OD28ID87401

> Message Body:

**Dear Sir/Madam,
We got your contact from one of your customers in the USA .
We have interest in purchasing your products and we sincerely hope to establish a long-term business relation with your esteemed company.
Please kindly check the attachment and find our COMPANY CATALOGUE,SAMPLE CATALOGUE/DESIGN and please do inform me if you make exactly the same with the right quality material.
Please kindly email me your latest catalog as attachment. Also, inform me about the MOQ, Delivery time, and payment terms.
Your early reply is highly appreciated. Thank You!
Best Regards,

Mrs Fiora Libard
(Purchasing Manager) **

> Subject: Fwd: Urgent Inquiry About Your Product

Message Body:

**I sent you an email previously based on our trial order but no response. Here is the exact sample of the product we wish to purchase from your company, so please confirm to us if you/your company can make provision of the exact product in attachment, which you can also view by downloading the attachment in this email and view the samples we need:
Upon the receipt of your confirmation, I shall forward to you the order quantity and delivery details,which will enable you to give us a proper quotation.Please download attachment to view our product sample.
Thank you.
Dyakonov, Maria
Temash Group Russia
Purchase coordinator
address: 620102,
Yekaterinburg, 9 Zoological street.
20017, Ekaterinburg, Kosmonavtov, 11-b, Lyter D, 2
nd Floor Actual
Yekaterinburg
RUSSIA
Tel: + 7 (343) 214-08-691
Fax: + 7 (343) 228-09-198
--
Amanda Cropper
Gecko Creative
151 S. Robinson St.
Baltimore, MD 21224
410.342.8140 phone
410.342.8143 fax
www.geckocreative.com
Minority Business Enterprise (MBE 06-122)
Small Business Reserve (SBR SB11-3669)
Minority/Women’s Business Enterprise (WBE 08-005202) **

> Subject: purchase order

Message Body:

**Hello
Am Mr. Berki, sales manager of TECHINATURAL LLC,
currently we are looking for supplier of your products.
We are interesting in your products in large quantity:
Kindly find attached a Purchase Order for what we need and quantity. Please check and quote similar items.
Please kindly quote your best prices so we can place an order. Thanks for your Kind Cooperation.
S.BerkI **

> Subject: **RE: requirement for this order **
Message Body:

**DHello Sir/Madam,
it is my pleasure to contact you in respect to my order i want to purchase from you so we can make a huge purchase Asap,
SIMCO Engineering, Ltd.,here in thailand has been in business of importing and exporting
Meanwhile,Before placing an order,i wanted to know if your company can supply me with my requirements.
I would like to know a little more about your company and your terms like,
1. Quality of goods and service after sale
2. Export and import licence terms
3. FOB price and FoB port
4. Delivery and shipment
5. payment terms.
For convinnence i have sent the attached Trails order list and sample pictures so you can reply me with facts and details
I await your response.
Regards,
Sales Manager
Engr Tamret Dale Gelly
email: [email protected]
Altn: [email protected]
SIMCO ENGINEERING LIMITED PARTNERSHIP GROUP LLC
Our address :
50/101 M.13 PUTTAMONTHON SAI5 RD / RAIKHING /SAMPRAN NAKORNPRATHOM /THAILAND/ 73210 TEL : +66-28119371 TO4 FAX : +66-8119375 E-MAIL : [email protected] **

> Subject: PURCHASE ORDER

Message Body:

**Dear Sir/Madam,
We are a multinational Marketing & Distribution company with global operations, based in the USA. As such we source product from China and other asian producing countries in order to distribute and sell these products through distribution and retailing. We currently distribute products very successfully in the states and all over the cities here in USA, and work on very large volumes of product.
We have interest in purchasing your products and we sincerely hope to establish a long-term business relation with your esteemed company.Please kindly check the attachment and find our PURCHASE ORDER,SAMPLE CATALOGUE/DESIGN and please do inform me if you make exactly the same with the right quality material.
Please kindly email me your latest catalog as attachment. Also, inform me about the MOQ, Delivery time, and payment terms.
Your early reply is highly appreciated. Thank You!
Best Regards,

Purchase Manager.
Mrs Elizabeth Brown**

> Message Body:

Dear Sir/madam
Currently we are looking for supplier of your products.
We are interesting in your products in large quantity:
Kindly find attached a Purchase Order for what we need and quantity.
Please check and quote similar items.
Please kindly quote your best prices so we can place an order.
Thanks for your Kind Cooperation.
Asamul
Purchasing manager
SAHIN MAKINA LLC

> Subject: Corporate eFax: You got a 2 page(s) fax

Message Body:

**Corporate eFax
bar
Fax Message [Caller-ID: 201-616-2038]
You got a 2 page(s) fax at Wed, 24 Oct 2012 19:45:48 +0700.

The reference number for this fax is xju3_wyb20-2012241019-7128487514-63.
Open this fax using your PDF reader.
Please visit www.eFax.com/en/efax/twa/page/help if you have any questions regarding this message or your service.
Thanks for using the eFax service!
Home Contact Login
Powered by j2
2012 j2 Global Communications, Inc. All rights reserved.
eFax is a registered trademark of j2 Global Communications, Inc.
This account is subject to the terms listed in the eFax Customer Agreement.**

> Subject: New Order

Message Body:

**Dear Sir/madam
Currently we are looking for supplier of your products.
We are interesting in your products in large quantity:
Kindly find attached a Purchase Order for what we need and quantity.
Please check and quote similar items.
Quote your best prices so we can place an order.
Thanks for your Kind Cooperation.
Asamul
Purchasing manager
ASTONISHING BUSINESS LLC
2763 MEADOW CHURCH RD. STE 207 DULUTH, GA 30097. **

> Subject: Your customer?s concern

Message Body:

**Better Business Bureau©
Start With Trust©
Fri, 02 Nov 2012 23:34:16 +0800
RE: Case #62502413
Hello Sirs,
The Better Business Bureau has got the above-referenced complaint from one of your customers in respect of their business relations with you. The detailed information about the consumer’s concern is included in enclosed document. Please open this problem and advise us of your point of view as soon as possible. We encourage you to open the COMPLAINT REPORT to respond on this complaint.
We look forward to your urgent response.
Yours faithfully,
Alonso Annice
Dispute Counselor
Better Business Bureau
VIEW ATTACHED REPORT: Report id #62502413
Council of Better Business Bureaus
3033 Wilson Blvd, Suite 600 Arlington, VA 22201
Phone: 1 (703) 276.0100 Fax: 1 (703) 525.8277 **

> Subject: RECEIPT OF THE 14000USD

Message Body:

Attn,
We have made the payment to your account please check your bank
account and get back to us asap
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

> Subject: PURCHASE ORDER

Message Body:

**SalesPerson / SalesManager,
My name is Smart Joachim and I am the procurement manager of waves
Trading Ltd.
We are a suppliers company to a lot of chain store and retail outlets in
California and Indeed over America. The product model we are asking
you to make
for , we have previously been supplied by a company in Guandong. However, due
to excessive demand, this supplier has been unable to meet up with the
delivery
schedules and the shortfall is beginning to bring a deficit on our
part. Please
note that Quality is very important to us. kindly download the attachment in
the folder to get full details of our order including required quantity and
pictures of a sample product model we have previously produced .
I. We currently have a client who is interested in buying your products.
Consequently, could you kindly provide a quotation for your said product with
the following details: Please provide quotations of at most 5
different product
designs and styles - for your most salable and newest items.
Please open/download the attached PURCHASE ORDER and give us all the
information we need as requested below.
1. Descr’+'iption of the Product -
2. MOQ (minimum order quantity) -
3. F.OB. Price - and Samples (for free or not?)
4. Port (FOB which port) - FOB
5. Packing details
6. Payment terms -
7. Delivery time (for mass production and for samples)-
II. Also, please provide us with a Catalogue of all the products your company
is currently manufacturing.
III. Also, please state your company type - manufacturing or trading? Our
client would like to visit
West Wales is typing…
West Wales: visit your company’s factory/warehouse. Kindly state where your
factory / warehouse location is too. .
IV. Could you also give me your skype id or direct phone number; This is to
facilitate faster communication between us.
Your immediate response would be highly appreciated.
Thank you
Best Regard,
Smart Joachim
waves Trading Ltd.
48 W 27th St Frnt,New York, NY 10001 **

> Subject: New Order/ Inquiry

Message Body:

**Dear Sir,
We write to inform you that we are interested in your products and the
attachment is sample needed.
We sincerely hope to establish a long-term business relations with your
esteemed corporation.
Please kindly send me your catalog,Please inform me about the Minimum
Order,Quantity Delivery time and Payment terms warranty.
Your early reply is highly appreciated.
Thank You.
Zhejiang/Wenzhou Tianniu Synthetic Leather Co., Ltd
Tell:86-507-86635197
Email : [email protected] , [email protected]
Web:www.tianneuleather.com **

> Subject: Email dispatch of purchase order 2800362756

Message Body:

**Dear Sir/Madam,
Hope you had a great holiday with your family and welcome back to work.
With reference to your quotation and the subsequent negotiation, we are
please to award the attached purchase order on you for supply of material /
providing service, subject to terms and conditions stated in the purchase
order and it’s annexure.
Please also endeavour to unzip the order as it is too large so you have to
extract
to enable you view the product.
Kindly acknowledge the receipt of this order and send your order acceptance
at the earliest.
Thanking you,
For Ambuja Tradings Limited **

> Subject: PAYMENT CONFIRMATION

Message Body:

**Hello.
Find attached payment confirmation as discussed.Regards
Singh **

> Subject: Your transaction is completed

Message Body:

Transaction is completed. $11231869 has been successfully transferred.
If the transaction was made by mistake please contact our customer service.
Receipt of payment is attached.
*** This is an automatically generated email, please do not reply*
Bank of America, N.A. Member FDIC. Equal Housing Lender Opens in new window
2013 Bank of America Corporation. All rights reserved N/A **

> Subject: Your transaction is completed

Message Body:

Transaction is completed. $07740449 has been successfully transferred.
If the transaction was made by mistake please contact our customer service.
Receipt of payment is attached.
*** This is an automatically generated email, please do not reply*
Bank of America, N.A. Member FDIC. Equal Housing Lender Opens in new window
Š 2013 Bank of America Corporation. All rights reserved **

> Subject: PURCHASE ORDER 3025

Message Body:

**Hi,
Kindly check the attached purchase order and arrange to despatch the
materials as soon as possible.
Take action with respect to the consolidation of the purchase order
and address the P/I.
Regards
Dmitrijs.Laura
Phone: 381 78945871
Fax: 381 7892564123 **

> Subject: IRON EXE_Attachment _

Message Body:

**Good day
our company wants to buy a large quantity of your products
please kindly open the above attached file to view all
our new order and product samples we need to purchase from you for you to send us your
proforma invoice ( P.I.)
please also advise us on the delivery time for we want to make a big purchase from you
after you might have viewed our order in the attachment we sent
we await your prompt response as soon as possible
regards
Rhona Chris,
International purchasing manager
Broadwalk company INC **

> Subject: Payment Advice - Advice Ref:[G52766575985] / Priority payment / Customer Ref:[38 478S200X6I]

Message Body:

**Sir/Madam
The attached payment advice is issued at the request of our customer. The advice is for your reference only.
Yours faithfully
Global Payments and Cash Management
HSBC

This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.

This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.

“SAVE PAPER - THINK BEFORE YOU PRINT!” **

> Subject: Payment Confirmation

Message Body:

**Good Morning
My name is Ellen Martinez,i was asked by my boss to send you the payment been made ??Earlier today.
Kindly see the attached payment slip for confirmation. Thus acknowledge the receipt of payment been made.
Thanks **

> Subject: T/T copy for new order

Message Body:

**Dear Sir,
Confirm your delivery schedule
Kindly check the attached TT deposit copy of your invoice and arrange
to dispatch the
materials as soon as possible.
Take action with respect to the consolidation of the purchase order
and address the P/I asap.
:20A SENDER’S REFERENCE
11044TRF12008119: 23B BANK OPERATION CODE
CRED: 32A CURRENCY/INTERBANK SETTLEMENT
131502US19744,64: 33B CURRENCY/INSTRUCTED AMOUNT
US31000: 50K ORDERING CUSTOMER
/AL36213110440000000000933729
W.T.M
Please check with your bank and confirm asap.
Thanks,
peter
PURCHASING MANAGER
PTY EMBELTON LTD **

> Subject: purchase order

Message Body:

**Greetings,
Attached to this mail is our purchase order, please furnish us with a proforma invoice and terms of payment as soon as possible.
We await to hear from you.
Thanks
Regards
Anthony
LINYI WANXIN ENAMEL PRODUCTS CO.,LTD
Email: [email protected] reply e-mail and immediately and permanently delete this message and any attachments. Thank you."

> Subject: Payment Advice - Advice Ref:[G55526943723] / Priority payment / Customer Ref:[38 174S200X6I]

Message Body:

**Sir/Madam
The attached payment advice is issued at the request of our customer. The advice is for your reference only.
Yours faithfully
Global Payments and Cash Management
HSBC

This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.

“SAVE PAPER - THINK BEFORE YOU PRINT!”**

> Message Body:

**Dear Sir or Madam,
We noticed that jewelry is your main business line which is our main
products too.
We will like to maintan a cordial business relationship with you.
Confirm the attached Catalogue
If you have any needs please don?t hesitate to contact us.
Hope to hear from you soon.
Sincerely
Michael Li
KAGARI PTE.,LTD.
Room 1405, No 322 Xianxia Road, Changning District, Shanghai China 200336
Mobiel: +86 18019487510
Tel: +86-21-62707523815 or 62707522815
Fax: +86-21-62707517 **

> Subject: Fw:New Order For 12 Containers

Message Body:

Dear Sirs,
I obtained catalogue of your products at the Canton fair, where I got
your contact details.
Upon reviewing your catalogue, we are interested in your products.
Kindly find the order enclosed as attachment.
Please send the best FOB price and the following…
1, MOQ
2, In how many colors can we choose a model?
3, Pictures of the available colors
4,Warranty
Hopefully you can assist us with this inquiry as soon as possible.
Thanks & Kind regards,
Eng. Alice Lee
Import Coordinator
Export-Import Department
E- COMPANY FOR TRADING INC.
…
, 2, 3 block 13021 1st industrial zone,
5th Floor, Bishop’s Square, Redmond’s Hill, Dublin 2, Ireland
+353 1 476 3400 FAX:
+353 1 476 3406

Cisco Security analysts examine real-world email traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global email security threats and trends. Cisco will continue to monitor this threat and automatically adapt systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.

Cisco security appliances protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Email that is managed by Cisco and end users who are protected by Cisco Web Security Appliances will not be impacted by these attacks. Cisco security appliances are automatically updated to prevent both spam email and hostile web URLs from being passed to the end user.

Revision History

* Version	Description	Date
75	Cisco Security has detected significant activity on May 6, 2015.	2015-May-06 12:23 GMT
74	Cisco Security has detected significant activity on July 10, 2013.	2013-July-11 13:10 GMT
73	Cisco Security has detected significant activity on July 6, 2013.	2013-July-08 12:27 GMT
72	Cisco Security has detected significant activity on July 3, 2013.	2013-July-03 14:52 GMT
71	Cisco Security has detected significant activity on July 1, 2013.	2013-July-01 17:20 GMT
70	Cisco Security has detected significant activity on June 27, 2013.	2013-June-27 14:09 GMT
69	Cisco Security has detected significant activity on June 21, 2013.	2013-June-24 16:01 GMT
68	Cisco Security has detected significant activity on June 21, 2013.	2013-June-21 13:39 GMT
67	Cisco Security has detected significant activity on June 18, 2013.	2013-June-19 13:25 GMT
66	Cisco Security has detected significant activity on June 18, 2013.

| | 2013-June-18 19:30 GMT
65 | Cisco Security has detected significant activity on June 15, 2013.

| | 2013-June-17 13:14 GMT
64 | Cisco Security has detected significant activity on June 10, 2013.

| | 2013-June-11 16:21 GMT
63 | Cisco Security has detected significant activity on June 10, 2013.

| | 2013-June-10 13:59 GMT
62 | Cisco Security has detected significant activity on June 4, 2013.

| | 2013-June-08 02:35 GMT
61 | Cisco Security has detected significant activity on June 4, 2013.

| | 2013-June-04 20:34 GMT
60 | Cisco Security has detected significant activity on June 4, 2013.

| | 2013-June-04 14:25 GMT
59 | Cisco Security has detected significant activity on May 31, 2013.

| | 2013-May-31 18:54 GMT
58 | Cisco Security has detected significant activity on May 27, 2013.

| | 2013-May-28 14:51 GMT
57 | Cisco Security has detected significant activity on May 24, 2013.

| | 2013-May-24 19:55 GMT
56 | Cisco Security has detected significant activity on May 22, 2013.

| | 2013-May-23 12:09 GMT
55 | Cisco Security has detected significant activity on May 22, 2013.

| | 2013-May-22 19:29 GMT
54 | Cisco Security has detected significant activity on May 21, 2013.

| | 2013-May-21 15:28 GMT
53 | Cisco Security has detected significant activity on May 20, 2013.

| | 2013-May-20 16:12 GMT
52 | Cisco Security has detected significant activity on May 19, 2013.

| | 2013-May-20 13:42 GMT
51 | Cisco Security has detected significant activity on May 17, 2013.

| | 2013-May-17 14:16 GMT
50 | Cisco Security has detected significant activity on May 15, 2013.

| | 2013-May-15 14:06 GMT
49 | Cisco Security has detected significant activity on May 11, 2013.

| | 2013-May-13 21:03 GMT
48 | Cisco Security has detected significant activity on May 9, 2013.

| | 2013-May-10 13:37 GMT
47 | Cisco Security has detected significant activity on May 7, 2013.

| | 2013-May-08 14:34 GMT
46 | Cisco Security has detected significant activity on April 30, 2013.

| | 2013-April-30 13:24 GMT
45 | Cisco Security has detected significant activity on April 29, 2013.

| | 2013-April-29 19:12 GMT
44 | Cisco Security has detected significant activity on April 26, 2013.

| | 2013-April-26 13:47 GMT
43 | Cisco Security has detected significant activity on April 25, 2013.

| | 2013-April-25 18:54 GMT
42 | Cisco Security has detected significant activity on April 24, 2013.

| | 2013-April-25 14:28 GMT
41 | Cisco Security has detected significant activity on April 24, 2013.

| | 2013-April-24 16:37 GMT
40 | Cisco Security has detected significant activity on April 20, 2013.

| | 2013-April-22 20:40 GMT
39 | Cisco Security has detected significant activity on April 15, 2013.

| | 2013-April-15 20:57 GMT
38 | Cisco Security has detected significant activity on April 4, 2013.

| | 2013-April-05 18:32 GMT
37 | Cisco Security has detected significant activity on March 26, 2013.

| | 2013-March-26 16:03 GMT
36 | Cisco Security has detected significant activity on February 28, 2013.

| | 2013-March-01 15:58 GMT
35 | Cisco Security has detected significant activity on February 25, 2013.

| | 2013-February-26 20:26 GMT
34 | Cisco Security has detected significant activity on February 13, 2013.

| | 2013-February-14 15:25 GMT
33 | Cisco Security has detected significant activity on February 8, 2013.

| | 2013-February-08 16:06 GMT
32 | Cisco Security has detected significant activity on February 4, 2013.

| | 2013-February-04 15:19 GMT
31 | Cisco Security has detected significant activity on January 28, 2013.

| | 2013-January-28 19:15 GMT
30 | Cisco Security has detected significant activity on January 28, 2013.

| | 2013-January-28 17:03 GMT
29 | Cisco Security has detected significant activity on January 23, 2013.

| | 2013-January-23 19:47 GMT
28 | Cisco Security has detected significant activity on January 22, 2013.

| | 2013-January-22 16:39 GMT
27 | Cisco Security has detected significant activity on January 10, 2013.

| | 2013-January-11 17:04 GMT
26 | Cisco Security has detected significant activity on January 5, 2013.

| | 2013-January-07 15:34 GMT
25 | Cisco Security has detected significant activity on December 01, 2012.

| | 2012-December-03 15:31 GMT
24 | Cisco Security has detected significant activity on November 20, 2012.

| | 2012-November-26 17:13 GMT
23 | Cisco Security has detected significant activity on November 7, 2012.

| | 2012-November-07 17:37 GMT
22 | Cisco Security has detected significant activity on November 2, 2012.

| | 2012-November-03 03:15 GMT
21 | Cisco Security has detected significant activity on October 29, 2012.

| | 2012-October-29 20:58 GMT
20 | Cisco Security has detected significant activity on October 24, 2012.

| | 2012-October-24 16:11 GMT
19 | Cisco Security has detected significant activity on October 19, 2012.

| | 2012-October-19 18:08 GMT
18 | Cisco Security has detected significant activity on October 18, 2012.

| | 2012-October-19 13:59 GMT
17 | Cisco Security has detected significant activity on October 10, 2012.

| | 2012-October-10 18:53 GMT
16 | Cisco Security has detected significant activity on September 29, 2012.

| | 2012-October-01 20:45 GMT
15 | Cisco Security has detected significant activity on September 27, 2012.

| | 2012-September-28 14:09 GMT
14 | Cisco Security has detected significant activity on September 17, 2012.

| | 2012-September-18 13:14 GMT
13 | Cisco Security has detected significant activity on September 15, 2012.

| | 2012-September-17 19:51 GMT
12 | Cisco Security has detected significant activity on September 4, 2012.

| | 2012-September-05 18:47 GMT
11 | Cisco Security has detected significant activity on August 21, 2012.

| | 2012-August-21 19:21 GMT
10 | Cisco Security has detected significant activity on August 13, 2012.

| | 2012-August-14 20:52 GMT
9 | Cisco Security has detected significant activity on August 7, 2012.

| | 2012-August-07 21:00 GMT
8 | Cisco Security has detected significant activity on August 2, 2012.

| | 2012-August-02 14:26 GMT
7 | Cisco Security has detected significant activity on July 31, 2012.

| | 2012-July-31 20:34 GMT
6 | Cisco Security has detected significant activity on July 31, 2012.

| | 2012-July-31 18:20 GMT
5 | Cisco Security has detected significant activity on July 18, 2012.

| | 2012-July-18 16:06 GMT
4 | Cisco Security has detected significant activity on June 21, 2012.

| | 2012-June-22 12:08 GMT
3 | Cisco Security has detected significant activity on March 13, 2012.

| | 2012-March-14 21:48 GMT
2 | Cisco Security has detected significant activity on March 12, 2012.

| | 2012-March-13 16:55 GMT
1 | Cisco Security has detected significant activity on March 5, 2012. | | 2012-March-06 18:23 GMT
Show Less

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products

JSON