Threat Outbreak Alert: Fake Delta E-Ticket Attachment Email Messages on March 29, 2016.

2012-10-03T15:13:21
ID CISCO-THREAT-27100
Type ciscothreats
Reporter Cisco
Modified 2016-03-29T19:23:19

Description

Medium

Alert ID:

27100

First Published:

2012 October 3 15:13 GMT

Last Updated:

2016 March 29 19:23 GMT

Version:

44

Summary

  • Cisco Security has detected significant activity related to spam email messages that claim to contain an e-ticket notification for the recipient. The text in the email message attempts to convince the recipient to open and download the attachment. However, the attachment contains a malicious .exe or .js file that, when executed, attempts to infect the system with malicious code.

Email messages that are related to this threat (RuleID4627 and RuleID4627KVR) may contain any of the following files:

> _Delta_A_Ticket_Print_Document_3525.zip
Delta_A_Ticket_Print_Document.exe
Delta_A_Ticket_Print_Document_3894.zip
Delta_A_Ticket_Print_Document_1998.zip
AA_Ticket_Print_Document.zip
AA_Ticket_Print_Document.exe
Delta_A_Ticket_Print_Document_1229.zip
Delta_A_Ticket_Print_Document_9319.zip
Delta_A_Ticket_Print_Document_6888.zip
Delta_A_Ticket_Print_Document_1773.zip
Delta_A_Ticket_Print_Document_7985.zip
Delta_A_Ticket_Print_Document_0490.zip
Delta_A_Ticket_Print_Document_8437.zip
Delta_A_Ticket_Print_Document_4104.zip
Delta_A_Ticket_Print_Document_1662.zip
E-ticket-BritishAirways.zip
E-ticket-BritishAirways.pdf.exe
BritishAirways-eticket-ReferenceLNW2IC.zip
BritishAirways-eticket.exe
eTicket-Emirates-0369046019244.zip
eTicket-Emirates-7655999302116.pdf.exe
eTicket and Receipt for ID53765945634564597623746287346287693486287568263984672
63596245663284682369498268354892634986234876248528374698137404568798057347
573204312462656.pdf.exe
eTicket.zip
TICKET-ID-67432-042013.zip
TICKET-ID-62232-042013.exe
TICKET-ID-67432-042013.exe
TICKET-ID-67232-042013.exe
Print.Image-E-ticket.zip
Print.Image-E-ticket.tiff.exe
Eticket-Reiseplan_PCSBHG.zip
Eticket-Reiseplan_PCSBHG.pdf.exe
Ticket_ticketweb_10737197.zip
Ticket_ticketweb_67510922.pdf.exe
Electronic_TK_Delta_59303.zip
E-TICKET_FOR_PRINT_AA4722.zip
E-TICKET_AA_FOR_PRINT_2013_ALL_RIGHTS_RECERVED.exe
Electronic_Ticket_Delta_AA07049.zip
Electronic_Ticket_Delta_Air_Lines_DA_EN.exe
Electronic_Ticket_Delta_AA10883.zip
Electronic_Ticket_Delta_Air_Lines.exe
Electronic_Ticket_Delta_AA10931.zip
Electronic_Ticket_Delta_Air_Lines_AA.exe
US_Airways_E-Ticket_NO35288.zip
US_AIRWAYS_E-TICKET_ONLINE FOR_PRINT.exe
US_Airways_E-Ticket_NO76475.zip
US_Airways_E-Ticket.exe
Ticket_Delta_AirLines_Doc_ID0724.zip
Ticket_Delta_AirLines_Document_to_print.exe
British_Airways_eTicket-692548D79A.zip
British_Airways_eTicket_ID85794856349823648961234.pdf.exe
AA_Airlines_E-Ticket_ID06809.zip
AA_Airlines_E-Ticket_For_Print_Doc.exe
Ticket_AA_Airlines_Print_IN0512.zip
Ticket_AA_Airlines_For_Print.exe
Ticket_Delta_AirLines_Print_doc_8615.zip
Ticket_Delta_AirLines_Print_Document.exe
AA_Airlines_E-Ticket_IDN58406.zip
AA_Airlines_E-Ticket_Print_document.exe
Document_Print_Ticket_DA3078.zip
Document_Print_Ticket_DA.exe
US_Airways_E-Ticket_NO61009.zip
E-Ticket_US-Air_Document.exe
Ticket_Delta_Air_Print_SN4055.zip
Ticket_Delta-Air_Doc_Print.exe
Ticket_Delta_Air_Document_IN31339.zip
E-Ticket_Delta_Air_Document.exe
E_Ticket_Customer_AAIN8897.zip
ELECTRONIC_TICKE'T_AA_AIR_PRINT_DOCUMENT.exe
Electronic_Ticket_AA_Customer_SN2873.zip
Electronic_Ticket_AA_Customer_SN0523.zip
DeltaTicket_ET-RM-0HJ423891156.zip
DeltaTicket_ET-RM-0HJ423891156.exe
DeltaTicket_ET-RM-0HJ08546868.zip
DeltaTicket_ET-RM-0HJ08546868.exe
DeltaTicket_ET-MF-007812321349.zip
DeltaTicket_ET-MF-007812321349.exe
tickets.2562068.zip
ticket.332091.exe
ET-01492960.zip
DeltaTicket.exe
ET-31634172.zip
ET-33022843.zip
ET-76142362.zip
ET-14081399.zip
ET-88705446.zip
ET-64333338.zip
DATicket.exe
ET-94360675.zip
ET-01659981.zip
TicketDA.exe
ET-69309488.zip
ET-73436689.zip
ET-20380006.zip
AA-0039007465.zip
ET-42799699.zip
DA-0058163509.zip
DA-0025888550.zip
DA-0096734284.zip
Miravet1957_invoices_869527.zip
ticket_613588769.js___

The _Delta_A_Ticket_Print_Document.exe _file in the _Delta_A_Ticket_Print_Document_3525.zip _attachment has a file size of 58,880 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0x9AE9BAAF1E335123927EB59B2627093D

A variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_3894.zip attachment has a file size of 56,832 bytes. The MD5 checksum is the following string: 0xBBEC3DAD9FC9988C4E2767F7722B88EA

A third variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_1998.zip attachment has a file size of 57,344 bytes. The MD5 checksum is the following string: 0x40589B6F72946CD01C87E0937EA4E3BA

The AA_Ticket_Print_Document.exe file in the AA_Ticket_Print_Document.zip attachment has a file size of 56,320 bytes. The MD5 checksum is the following string: 0x9FC92B308E9D68AAED9840D663BC2CF2

A variant of the AA_Ticket_Print_Document.exe file in the AA_Ticket_Print_Document.zip attachment has a file size of 76,288 bytes. The MD5 checksum is the following string: 0x4AB39183187C4A12199C0635935A957C

A second variant of the AA_Ticket_Print_Document.exe file in the AA_Ticket_Print_Document.zip attachment has a file size of 56,832 bytes. The MD5 checksum is the following string: 0x77D42E71BA23BA45B42A7B1DCD648D31

A third variant of the AA_Ticket_Print_Document.exe file in the AA_Ticket_Print_Document.zip attachment has a file size of 56,832 bytes. The MD5 checksum is the following string: 0x8F6B7DC60CCBEEF55954E071C6A265B7

A fourth variant of the AA_Ticket_Print_Document.exe file in the AA_Ticket_Print_Document.zip attachment has a file size of 80,384 bytes. The MD5 checksum is the following string: 0xAD921B3B29CF1AFCA460234A610A9660

A fourth variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_1229.zip attachment has a file size of 79,872 bytes. The MD5 checksum is the following string: 0xE3207747EE5EA87B753CCA9E7BDA45F1

A fifth variant of the_ Delta_A_Ticket_Print_Document.exe_ file in the Delta_A_Ticket_Print_Document_9319.zip attachment has a file size of 87,040 bytes. The MD5 checksum is the following string: 0xB22BB2FE73759E24822FBD9425745801

A sixth variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_6888.zip attachment has a file size of 50,257 bytes and the MD5 is unavailable.

A seventh variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_1773.zip attachment has a file size of 54,272 bytes. The MD5 checksum is the following string: 0x5ED85CEB346A46B7F029CD3E249EAE8C

An eighth variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_7985.zip attachment has a file size of 51,712 bytes. The MD5 checksum is the following string: 0xEB438C739F9CFFD68C00BB96D853637D

A ninth variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_0490.zip attachment has a file size of 53,248 bytes. The MD5 checksum is the following string: 0xD518DA6953A2E605A14086A69F674A3F

A tenth variant of the Delta_A_Ticket_Print_Document.exe file in the _Delta_A_Ticket_Print_Document__8437.zip _attachment has a file size of 52,736 bytes. The MD5 checksum is the following string: 0xDB480323FCC4B48AFD60FBFBCD1D268A

An 11th variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_4104.zip attachment has a file size of 50,176 bytes. The MD5 checksum is the following string: 0xB4CD6C46D789C322876B6BB74EC62357

A 12th variant of the Delta_A_Ticket_Print_Document.exe file in the Delta_A_Ticket_Print_Document_1662.zip attachment has a file size of 54,272 bytes. The MD5 checksum is the following string: 0x39DD32C51C33D9283FB35B055A261031

The E-ticket-BritishAirways.pdf.exe file in the E-ticket-BritishAirways.zip attachment has a file size of 42,343 bytes. The MD5 checksum is the following string: 0x759DFAF66AC795ACB4BF73E1C7360C6A

The BritishAirways-eticket.exe file in the BritishAirways-eticket-ReferenceLNW2IC.zip attachment has a file size of 54,784 bytes. The MD5 checksum is the following string: 0xB46709CF7A6FF6071A6342EFF3699BF0

The eTicket-Emirates-7655999302116.pdf.exe file in the eTicket-Emirates-0369046019244.zip attachment has a file size of 85,863 bytes. The MD5 checksum is the following string: 0x83783BE423D521A485EEC93322674760

The_ eTicket and Receipt for ID537659456345645976237462873462876934862875682639846
72635962456632846823694982683548926349862348762
48528374698137404568798057347573204312462656.pdf.exe_ file in the eTicket.zip attachment has a file size of 193,536 bytes. The MD5 checksum is the following string: 0xA98D8BF1D8B68477867EBAE47F0D5086

The TICKET-ID-67432-042013.exe file in the TICKET-ID-67432-042013.zip attachment has a file size of 238,080 bytes. The MD5 checksum is the following string: 0x917E3CBB690E233D4F20FD7E8B4AFAF3

The TICKET-ID-67232-042013.exe file in the TICKET-ID-67432-042013.zip attachment has a file size of 247,296 bytes. The MD5 checksum is the following string: 0x56673237CB5FB0748D0373FD8F26F88F

The TICKET-ID-62232-042013.exe file in the TICKET-ID-67432-042013.zip attachment has a file size of 245,760 bytes. The MD5 checksum is the following string: 0x247C67CB99922FD4D0E2CA5D6976FC29

The Print.Image-E-ticket.tiff.exe file in the Print.Image-E-ticket.zip attachment has a file size of 63,640 bytes. The MD5 checksum is the following string: 0x12B14DC0B1211CE285C2C0E9A2501974

The Eticket-Reiseplan_PCSBHG.pdf.exe file in the Eticket-Reiseplan_PCSBHG.zip attachment has a file size of 37,510 bytes. The MD5 checksum is the following string: 0xF1F3D983E68BA806660F4E2347561638

The Ticket_ticketweb_67510922.pdf.exe file in the Ticket_ticketweb_10737197.zip attachment has a file size of 88,277 bytes. The MD5 checksum is the following string: 0x31B56FF16E3E6F35CF11399762C1A16F

The Electronic_Ticket_Delta_Air_Lines.exe file in the Electronic_TK_Delta_59303.zip attachment has a file size of 101,376 bytes. The MD5 checksum is the following string: 0xBAD50CA248692957AE7A7BFD4FB43A73

The E-TICKET_AA_FOR_PRINT_2013_ALL_RIGHTS_RECERVED.exe file in the E-TICKET_FOR_PRINT_AA4722.zip attachment has a file size of 95,744 bytes. The MD5 checksum is the following string: 0x87BA9633A7F1D821143246154492D7C3

The Electronic_Ticket_Delta_Air_Lines_DA_EN.exe file in the _Electronic_Ticket_Delta_AA07049.zip _attachment has a file size of 95,232 bytes. The MD5 checksum is the following string: 0x06787CE79FAFD6B0AA05A546FE66B331

A variant of the Electronic_Ticket_Delta_Air_Lines.exe file in the Electronic_Ticket_Delta_AA10883.zip attachment has a file size of 101,376 bytes. The MD5 checksum is the following string: 0x86C30C82A95E7404315C3EFE29B3656B

The Electronic_Ticket_Delta_Air_Lines_AA.exe file in the Electronic_Ticket_Delta_AA10931.zip attachment has a file size of 100,864 bytes. The MD5 checksum is the following string: 0x98C3BFA750DFFED0D0B26E4E90B3BCB4

The US_AIRWAYS_E-TICKET_ONLINE FOR_PRINT.exe file in the US_Airways_E-Ticket_NO35288.zip attachment has a file size of 95,232 bytes. The MD5 checksum is the following string: 0x9F643AA9FA864FC592877EE14E7EB558

The_ US_Airways_E-Ticket.exe_ file in the US_Airways_E-Ticket_NO76475.zip attachment has a file size of 95,232 bytes. The MD5 checksum is the following string: 0xCC6EE044F7227E237191624F06BD540E

The Ticket_Delta_AirLines_Document_to_print.exe file in the Ticket_Delta_AirLines_Doc_ID0724.zip attachment has a file size of 95,232 bytes. The MD5 checksum is the following string: 0xBC17832BCD79E71FCD2CDF0249A24AFB

The British_Airways_eTicket_ID85794856349823648961234.pdf.exe file in the British_Airways_eTicket-692548D79A.zip attachment has an approximate file size of 115,179 bytes. The MD5 checksum is not available.

The AA_Airlines_E-Ticket_For_Print_Doc.exe file in the AA_Airlines_E-Ticket_ID06809.zip attachment has a file size of 94,720 bytes. The MD5 checksum is the following string: 0xD41CE3F6BAE1B189D8BEA8AD13F73D25

The Ticket_AA_Airlines_For_Print.exe file in the Ticket_AA_Airlines_Print_IN0512.zip attachment has a file size of 95,232 bytes. The MD5 checksum is the following string: 0x87B409C98EF17A5DE411021939F01362

The Ticket_Delta_AirLines_Print_Document.exe file in the_ Ticket_Delta_AirLines_Print_doc_8615.zip_ attachment has a file size of 203,264 bytes. The MD5 checksum is the following string: 0xD4EFB2B7B66907FBC41CD308B813FA04

The AA_Airlines_E-Ticket_Print_document.exe file in the AA_Airlines_E-Ticket_IDN58406.zip attachment has a file size of 210,616 bytes. The MD5 checksum is the following string: 0x2B261DC038DA6ECACCECA172406FBB73

The Document_Print_Ticket_DA.exe file in the Document_Print_Ticket_DA3078.zip attachment has a file size of 210,656 bytes. The MD5 checksum is the following string: 0xCBF02C015B833B366C9A5FA0D5775BCD

The E-Ticket_US-Air_Document.exe file in the US_Airways_E-Ticket_NO61009.zip attachment has a file size of 164,512 bytes. The MD5 checksum is the following string: 0xCAD48F0EAC5F0F78CDE6417D042C7D5A

The Ticket_Delta-Air_Doc_Print.exe file in the Ticket_Delta_Air_Print_SN4055.zip attachment has a file size of 173,752 bytes. The MD5 checksum is the following string: 0xC55F7AE198C8177394257A5FE50AE63A

The E-Ticket_Delta_Air_Document.exe file in the Ticket_Delta_Air_Document_IN31339.zip attachment has a file size of 164,536 bytes. The MD5 checksum is the following string: 0xA742BFA421E6ED5AF11F04D84E8E4EAF

The ELECTRONIC_TICKE'T_AA_AIR_PRINT_DOCUMENT.exe file in the E_Ticket_Customer_AAIN8897.zip attachment has a file size of 113,152 bytes. The MD5 checksum is the following string: 0xBC0307F01891A8C5FBE2BCD7DEAC540A

A variant of the ELECTRONIC_TICKE'T_AA_AIR_PRINT_DOCUMENT.exe file in the Electronic_Ticket_AA_Customer_SN2873.zip attachment has an approximate file size of 85,596 bytes. The MD5 checksum is not available.

A third variant of the ELECTRONIC_TICKE'T_AA_AIR_PRINT_DOCUMENT.exe file in the Electronic_Ticket_AA_Customer_SN0523.zip attachment has an approximate file size of 85,596 bytes. The MD5 checksum is not available.

The DeltaTicket_ET-RM-0HJ423891156.exe file in the DeltaTicket_ET-RM-0HJ423891156.zip attachment has a file size of 139,264 bytes. The MD5 checksum is the following string: 0xC475B6AF1BF1C9E729D57943A33C49CD

A variant of the_ DeltaTicket_ET-RM-0HJ423891156.exe_ file in the_ DeltaTicket_ET-RM-0HJ423891156.zip_ attachment has a file size of 93,696 bytes. The MD5 checksum is the following string: 0x5E6610B612A732A2879B02C178F182BC

The DeltaTicket_ET-RM-0HJ08546868.exe file in the _DeltaTicket_ET-RM-0HJ08546868.zip _attachment has a file size of 144,384 bytes. The MD5 checksum is the following string: 0x4FADDDB172A4BEDAB7A17228500A02BE

A variant of the DeltaTicket_ET-RM-0HJ08546868.exe file in the DeltaTicket_ET-RM-0HJ08546868.zip attachment has a file size of 144,384 bytes. The MD5 checksum is the following string: 0x8F99B926832366A3ADE0BAF3326E50B1

A third variant of the DeltaTicket_ET-RM-0HJ423891156.exe file in the DeltaTicket_ET-RM-0HJ423891156.zip attachment has a file size of 93,696 bytes. The MD5 checksum is the following string: 0x34163B8966287E099D04E54E1C8D0B9F

A fourth variant of the DeltaTicket_ET-RM-0HJ423891156.exe _file in the DeltaTicket_ET-RM-0HJ423891156.zip_ attachment has a file size of 93,696 bytes. The MD5 checksum is the following string: 0x1B04667FD5F6018ED52087222E36279A

The DeltaTicket_ET-MF-007812321349.exe file in the DeltaTicket_ET-MF-007812321349.zip attachment has a file size of 154,092 bytes. The MD5 checksum is the following string: 0x3985286BAF01FD3C71B6C559D75983CD

The ticket.332091.exe file in the tickets.2562068.zip attachment has a file size of 140,542 bytes. The MD5 checksum is the following string: 0x0FB1C40BDB35747ED51536AFD6A2B234

The DeltaTicket.exe file size in the ET-01492960.zip attachment is unavailable. The MD5 checksum is the following string: 0x5Dd64FE00BB2B817EDD68A8F135FBBCD

A variant of the DeltaTicket.exe file size in the ET-31634172.zip attachment has a file size of 93,696 bytes. The MD5 checksum is the following string: 0xC10BAA8BDA5D393C520B597B85035D4A

A second variant of the DeltaTicket.exe file size in the ET-33022843.zip attachment has a file size of 94,208 bytes. The MD5 checksum is the following string: 0x185391CE01B90FF6EDEE7662B6897D85

A third variant of the DeltaTicket.exe file size in the ET-76142362.zip attachment has a file size of 154,624 bytes. The MD5 checksum is the following string: 0x54049882E8AF93D3D22DCDEA33A0CE33

A fourth variant of the DeltaTicket.exe file in the ET-14081399.zip attachment has a file size of 94,208 bytes. The MD5 checksum is the following string: 0x2EF96D1ECEC9E26B3DA8CF7DCAAD9DF0

A fifth variant of the_ DeltaTicket.exe_ file in the ET-88705446.zip attachment has a file size of 139,776 bytes. The MD5 checksum is the following string: 0xB19AF4D1BF7FD962BEF11AA922D322A0

The_ DATicket.exe_ file in the ET-64333338.zip attachment has a file size of 94,208 bytes. The MD5 checksum is the following string: 0x465F80A0C89A4958B4885D312B101F50

A variant of the DATicket.exe file in the ET-94360675.zip attachment has a file size of 100,352 bytes. The MD5 checksum is the following string: 0xD15A5C31409FDB5A032FC8D99534228B

The TicketDA.exe file in the ET-01659981.zip attachment has a file size of 102,400 bytes. The MD5 checksum is not available.

A third variant of the DATicket.exe file in the ET-69309488.zip attachment has a file size of 151,552 bytes. The MD5 checksum is the following string: 0x102DB17C75C581D3E2DC8F606B658125

A fourth variant of the DATicket.exe file in the ET-73436689.zip attachment has an approximate file size of 77,824 bytes. The MD5 checksum is not available.

A fifth variant of the_ DATicket.exe_ file in the ET-20380006.zip attachment has an approximate file size of 151,556 bytes. The MD5 checksum is the following string: 0xCEB1D2E19F87FE342965E6439DDD5825

A sixth variant of the DATicket.exe file in the AA-0039007465.zip attachment has an approximate file size of 156,672 bytes. The MD5 checksum is the following string: 0xFCA405BF51FCBC429E8E9F69EFB094E8

A seventh variant of the DATicket.exe file in the ET-42799699.zip attachment has a file size of 86,528 bytes. The MD5 checksum is the following string: 0xF9771939ABD1AD71B537435A54BEE176

A sixth variant of the DeltaTicket.exe file in the DA-0058163509.zip attachment has a file size of 86,528 bytes. The MD5 checksum is the following string: 0x0C6D816EC2C057DA5B076DF3F68FB2C4

A seventh variant of the DeltaTicket.exe file in the DA-0025888550.zip attachment has a file size of 86,528 bytes. The MD5 checksum is the following string: 0xFAC456F4ED71B2C117FA2D7540D9435A

A eighth variant of the DeltaTicket.exe _file in the _DA-0096734284.zip attachment has a file size of 86,528 bytes. The MD5 checksum is the following string: 0x0C6D816EC2C057DA5B076DF3F68FB2C4

The ticket_613588769.js file in the Miravet1957_invoices_869527.zip attachment has a file size of 6,400 bytes. The MD5 checksum is the following string: 0xB9581262DB3809ED5127175dA553534F

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: Download your ticket

> Message Body:

Hello,
E-TICKET NUMBER / EH558468816
SEAT / 41E/ZONE 2
DATE / TIME 26 OCTOBER, 2012, 08:45 AM
ARRIVING / Phoenix
FORM OF PAYMENT / CC
TOTAL PRICE / 254.86 USD
REF / OE.7044 ST / OK
BAG / 2PC

Your bought ticket is attached.
You can print your ticket.

Thank you
Delta Air Lines.

Or

> Subject: Please download your ticket #NR1614

Message Body:

Dear Customer,
ELECTRONIC TICKET / 2 605 8706183005 2
SEAT / 52F/ZONE 2
DATE / TIME 20 OCTOBER, 2012, 10:30 PM
ARRIVING / Tulsa
FORM OF PAYMENT / CC
TOTAL PRICE / 227.27 USD
REF / OE2617 ST / OK
BAG / 6PC
Your bought ticket is attached.
To use your ticket you should print it.
Thank you for your attention.
American Airlines.

Or

> Subject: Your order #ID8195 is processed

Message Body:

Dear Customer,
E-TICKET NUMBER / 3 778 1360810855 3
SEAT / 05F/ZONE 3
DATE / TIME 20 OCTOBER, 2012, 10:21 AM
ARRIVING / Santa Ana
FORM OF PAYMENT / CC
TOTAL PRICE / 315.15 USD
REF / EK3345 ST / OK
BAG / 6PC
Please find your ticket attached.
To use your ticket you should print it.
Thank you for using our airline company services.
American Airlines.

Or

> Subject: Your order #NR3523 is processed

Message Body:

Hello,
TICKET / EH294203170
SEAT / 57A/ZONE 1
DATE / TIME 27 AUGUST, 2012, 08:15 PM
ARRIVING / Houston
FORM OF PAYMENT / CC
TOTAL PRICE / 272.88 USD
REF / EF.2286 ST / OK
BAG / 6PC
Please find your ticket attached.
You can print your ticket.
Thank you for using our airline company services.
Delta Air Lines.
About one third of South African truckers end strike
U.S. diplomatic security unit under scrutiny after Libya attack
US futures mixed ahead of US earnings season
Nobel for quantum "parlor trick" that could make super computers
Illustrated Ke$ha memoir coming in November

Or

> Subject: Order NR3194

Message Body:

Notification,
TICKET NUMBER / EH585057574
SEAT / 76F/ZONE 2
DATE / TIME 3 AUGUST, 2012, 09:45 AM
ARRIVING / Tulsa
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 285.05 USD
REF / KE.6554 ST / OK
BAG / 2PC
Your bought ticket is attached.
You can print your ticket.
Thank you for using our airline company services.
Delta Air Lines.
Hope dims in race to find man in collapsed Florida garage
Yemeni security officer for US Embassy killed
U.S. Air National Guard Procures 50 Building Alert Units for Common Area Alerting at Martin State Airport Maryland
Safeway's profitability slips on launch of program
Conservatives remind Romney of abortion pledge

Or

> Subject: Please download your ticket #1641

Message Body:

Notification,
TICKET NUMBER / EH302724290
SEAT / 60A/ZONE 1
DATE / TIME 10 AUGUST, 2012, 08:15 PM
ARRIVING / Stockton
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 281.52 USD
REF / OE.1620 ST / OK
BAG / 3PC
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for using our airline company services.
Delta Air Lines.
Forceful Raddatz draws praise as moderator
Octavia Spencer writing books for middle schoolers
Can we save our heritage?
Woman sues company at center of deadly meningitis outbreak
WikiLeaks fundraising stunt draws Anonymous ire

Or

> Subject: Your order #14-5031 has been completed

Message Body:

Hello,
E-TICKET NUMBER / EH469923423
SEAT / 55F/ZONE 2
DATE / TIME 15 NOVEMBER, 2012, 12:35 PM
ARRIVING / Huntington Beach
FORM OF PAYMENT / CC
TOTAL PRICE / 277.35 USD
REF / LE.0397 ST / OK
BAG / 4PC
Your bought ticket is attached to the letter as a scan document.
To use your ticket you should print it.
Thank you for your attention.
Delta Air Lines.
Giants sweep Tigers for World Series title

Or

> Subject: Your eReceipt Details

Message Body:

Dear Customer,
Thank you for choosing Emirates!
Please find your E-Ticket attached with this email.
We wish you a pleasant journey!
Regards,
Emirates
Please do not reply to this message using the "reply" address. However, your feedback is important to us. Please click on the link
(Customer Satisfaction Survey) if you would like to provide information regarding your customer service experience today.
If you do not receive your eTickets as a PDF attachment, please check your computer settings or alternatively you can re-print your eTickets online by going to www.emirates.com 'Manage my existing booking' section.

Or

> Subject: Your eTicket and receipt

Message Body:

Thank you for choosing Delta.
We encourage you to review this information before your trip.
If you need to contact Delta or check on your flight information, go to http://www.delta.com.
Your eTicket is attached to your email receipt as a PDF document.
Baggage and check-in requirements vary by airport and airline, so please check with the operating carrier on your ticket.
Please review Delta's check-in Requirements and baggage guidelines for details.
You must be checked in and at the gate at least 15 minutes before your scheduled departure time for travel inside the United States.
You must be checked in and at the gate at least 45 minutes before your scheduled departure time for international travel.

Or

> Subject: UNIFORM TRAFFIC TICKET

Message Body:

New York State — Department of Motor Vehicles
UNIFORM TRAFFIC TICKET
POLICE AGENCY
NEW YORK STATE POLICE
Local Police Code
THE PERSON DESCRIBED ABOVE IS CHARGED ASFOLLOWS
Time
7: 25 AM
Date of Offense
27/04/2013
IN VIOLATION OF
NYS V AND T LAW
Description of Violation
SPEED OVER 55 ZONE
TO PLEAD, PRINT OUT THE ENCLOSED TICKET ANDSEND IT TO TOWN COURT, CHATAM HALL., PO BOX 117

Or

> Subject: Your flight ticket is not activated yet

Message Body:

Dear copczv@miffcrffodf.com
Your flight ticket number: #9178862-5894553-BA-7198573857 is not activated yet!
I order to activate the ticket (confirming your identity) please download the attachment and follow the instructions.
Please print the confirmation and present it at the check-in point at the airport.
British Airways Plc, Waterside, PO Box 365,
Harmondsworth,
UB7 0GB.
Registered in England: 1777777. VAT number: 222452988. Member of IATA & AEA.

Or

> Subject: Ticket is ready

Or

> Message Body:

Notification,
ELECTRONIC TICKET NUMBER / ET-MF-007812321349
SEAT / 30A/ZONE 2
DATE / TIME 27 OCTOBER, 2014, 11:15 AM
ARRIVING / Phoenix
FORM OF PAYMENT / CC
TOTAL PRICE / 279.53 USD
REF / KE.8258 ST / OK
BAG / 1PC
Your bought ticket is attached.
You can print your ticket.
Thank you for using our airline company services.
Delta Air Lines.

Or

> Subject: (See attached file: grsbbmne.eml)

Or

> Subject: Order #00293262

Message Body:

Notification,
E-TICKET NUMBER / ET-17041432
SEAT / 53F/ZONE 1
DATE / TIME 7 OCTOBER, 2014, 12:25 PM
ARRIVING / Tulsa
FORM OF PAYMENT / CC
TOTAL PRICE / 243.24 USD
REF / EF.1897 ST / OK
BAG / 1PC
8BR9Your ticket is attached.
You can print your ticket.
Thank you
Delta Air Lines.

> > > Or

> Subject: FW: Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.

Message Body:

If you have any questions please let us know.

Cisco Security analysts examine real-world email traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global email security threats and trends. Cisco will continue to monitor this threat and automatically adapt IronPort systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.

Cisco security appliances protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Email that is managed by Cisco and end users who are protected by Cisco Web Security Appliances will not be impacted by these attacks. Cisco security appliances are automatically updated to prevent both spam email and hostile web URLs from being passed to the end user.

Related Links
Cisco Security
Cisco SenderBase Security Network

Revision History

  • Version | Description | Section | Date
    ---|---|---|---
    44 | Cisco Security has detected significant activity on March 29, 2016. | | 2016-March-29 19:23 GMT
    43 | Cisco Security has detected significant activity on November 7, 2014. | | 2014-November-10 15:16 GMT
    42 | Cisco Security has detected significant activity on October 6, 2014. | | 2014-October-08 11:27 GMT
    41 | Cisco Security has detected significant activity on October 1, 2014. | | 2014-October-02 14:07 GMT
    40 | Cisco Security has detected significant activity on September 30, 2014. | | 2014-October-01 11:40 GMT
    39 | Cisco Security has detected significant activity on September 22, 2014. | | 2014-September-24 12:57 GMT
    38 | Cisco Security has detected significant activity on September 20, 2014. | | 2014-September-22 14:15 GMT
    37 | Cisco Security has detected significant activity on September 17, 2014. | | 2014-September-19 12:55 GMT
    36 | Cisco Security has detected significant activity on September 15, 2014. | | 2014-September-16 12:31 GMT
    35 | Cisco Security has detected significant activity on September 10, 2014. | | 2014-September-15 13:13 GMT
    34 | Cisco Security has detected significant activity on September 10, 2014. | | 2014-September-11 13:23 GMT
    33 | Cisco Security has detected significant activity on September 8, 2014. | | 2014-September-08 19:09 GMT
    32 | Cisco Security has detected significant activity on September 6, 2014. | | 2014-September-08 14:06 GMT
    31 | Cisco Security has detected significant activity on September 2, 2014. | | 2014-September-03 13:33 GMT
    30 | Cisco Security has detected significant activity on September 2, 2014. | | 2014-September-02 14:41 GMT
    29 | Cisco Security has detected significant activity on December 19, 2013. | | 2013-December-20 13:18 GMT
    28 | Cisco Security has detected significant activity on December 18, 2013. | | 2013-December-19 13:47 GMT
    27 | Cisco Security has detected significant activity on December 17, 2013. | | 2013-December-18 13:43 GMT
    26 | Cisco Security has detected significant activity on December 16, 2013. | | 2013-December-17 14:13 GMT
    25 | Cisco Security has detected significant activity on December 13, 2013.

| | 2013-December-16 14:55 GMT
24 | Cisco Security has detected significant activity on December 12, 2013.

| | 2013-December-13 13:24 GMT
23 | Cisco Security has detected significant activity on December 11, 2013.

| | 2013-December-12 13:50 GMT
22 | Cisco Security has detected significant activity on December 10, 2013.

| | 2013-December-11 18:03 GMT
21 | Cisco Security has detected significant activity on December 6, 2013.

| | 2013-December-09 15:16 GMT
20 | Cisco Security has detected significant activity on September 25, 2013.

| | 2013-September-25 14:03 GMT
19 | Cisco Security has detected significant activity on September 4, 2013.

| | 2013-September-04 13:24 GMT
18 | Cisco Security has detected significant activity on July 24, 2013.

| | 2013-July-24 14:25 GMT
17 | Cisco Security has detected significant activity on May 7, 2013.

| | 2013-May-08 14:45 GMT
16 | Cisco Security has detected significant activity on May 7, 2013.

| | 2013-May-07 19:23 GMT
15 | Cisco Security has detected significant activity on March 5, 2013.

| | 2013-March-05 15:31 GMT
14 | Cisco Security has detected significant activity on February 14, 2013.

| | 2013-February-14 17:03 GMT
13 | Cisco Security has detected significant activity on November 21, 2012.

| | 2012-November-26 17:24 GMT
12 | Cisco Security has detected significant activity on November 6, 2012.

| | 2012-November-06 14:48 GMT
11 | Cisco Security has detected significant activity on October 29, 2012.

| | 2012-October-29 20:39 GMT
10 | Cisco Security has detected significant activity on October 14, 2012.

| | 2012-October-15 13:40 GMT
9 | Cisco Security has detected significant activity on October 12, 2012.

| | 2012-October-12 19:11 GMT
8 | Cisco Security has detected significant activity on October 11, 2012.

| | 2012-October-11 14:45 GMT
7 | Cisco Security has detected significant activity on October 10, 2012.

| | 2012-October-10 18:46 GMT
6 | Cisco Security has detected significant activity on October 9, 2012.

| | 2012-October-09 21:52 GMT
5 | Cisco Security has detected significant activity on October 8, 2012.

| | 2012-October-08 20:56 GMT
4 | Cisco Security has detected significant activity on October 5, 2012.

| | 2012-October-05 14:15 GMT
3 | Cisco Security has detected significant activity on October 4, 2012.

| | 2012-October-04 20:58 GMT
2 | Cisco Security has detected significant activity on October 3, 2012.

| | 2012-October-04 16:38 GMT
1 | Cisco Security has detected significant activity on October 2, 2012. | | 2012-October-03 15:13 GMT
Show Less


Legal Disclaimer

  • THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products