Threat Outbreak Alert: Fake Payroll Invoice Email Messages on June 11, 2014

Medium

Alert ID:

31268

First Published:

2013 October 15 19:34 GMT

Last Updated:

2014 June 12 12:44 GMT

Version:

61

Summary

• Cisco Security has detected significant activity related to spam email messages that claim to contain payroll invoice details for the recipient. The text in the email message attempts to convince the recipient to open the attachment and view the details. However, the .zip attachment contains a malicious .exe file that, when executed, attempts to infect the system with malicious code.

Email messages that are related to this threat (RuleID4961KVR, RuleID4961_1KVR, RuleID4961KVR_2, RuleID4961KVR_3, RuleID4961_2KVR, RuleID4961_3KVR, and RuleID4961_4KVR) may contain any of the following files:

> invoice.zip
invoice_389419201.pdf.exe
IMG6115429216-JPG.zip
IMG7862402593-JPG.scr
report.zip
report.pdf.exe
Confirming 416005738037.zip
Confirming 874009485990.docx.exe
PO_List.pdf.zip
sampl??fdp.exe
image 1016_059625_675.zip
image 1016_007499_005.jpeg.exe
IMG1465905579-JPG.zip
IMG1831967145-JPG.scr
IMG1737005922-JPG.zip
IMG8158191843-JPG.scr
17-10-2013 52_05_44.zip
17-10-2013 14_42_04.jpeg.exe
IMG0107656305-JPG.zip
IMG7617999738-JPG.scr
Fotos_Facebook-718029896.zip
Fotos_Facebook_12548521_JPG.scr
packing-list.zip
packing-list.exe
catalog.rar
2013 Ihre aktuelle Rechnung 9006459112.pdf.exe
foto_image 22-10-2013 607.zip
foto_image 22-10-2013.jpeg.exe
IMG1783996440-JPG.zip
IMG7226578219-JPG.scr
IMG4243329580-JPG.zip
IMG5676305001-JPG.scr
23-10-2013 24_88_85.zip
23-10-2013 13_64_09.jpeg.exe
IMG6624460956-JPG.zip
IMG1446633764-JPG.scr
Extrato_multas-551089129.zip
Extrato_multa_DOC.scr
P.O 43215.JPEG.zip
P.O 43215.JPEG.SCR
IMG1810984147-JPG.zip
IMG2913638301-JPG.scr
invoice_203519357-125mo.pdf.exe
IMG3331191846-JPG.zip
IMG4516776866-JPG.scr
IMG8354200653-JPG.zip
IMG4635208144-JPG.scr
Data L Approval.zip
New_Order_Quotation-pdf.exe
52ba4f5ecec96fd6f958497e8713f09e.zip
hesperbot_info.exe
28ottobre2013_98475003IMG.zip
28ottobre2013_98475003IMG.jpeg.exe
27_Oktober IMG_28223894.zip
27_Oktober IMG_90085331.jpeg.exe
VOICEATT281043884333.WMA.zip
VOICEATT281043884333.WMA.exe
P.O 412356.pdf.zip
P.O 412356.pdf.pif
SCANNEDCHECK31102013.JPEG.zip
SCANNEDCHECK31102013.JPEG.exe
invoice.zip
invoice_9103812-1232iq.pdf.exe
Scanned_Image.pdf.zip
Scanned_Image.pdf.exe
IMG5518718145-JPG.zip
IMG1835129955-JPG.scr
invoice_891640125661_24691ao.pdf.exe
P.O_26FP56.zip
P.O 750 MT-LLC.exe
Bank__Payment__Confirmation__Receipt_pdf.zip
Bank__Payment__Confirmation__Receipt_pdf.exe
McAfee Reactivation Wizard.zip
McAfee Reactivation Wizard.pdf.exe
Velma_photo_album_19fa1.zip
photo_album.zip.exe
IMG6973932987-JPG.zip
IMG9315555649-JPG.scr
IMG1359250380-JPG.zip
IMG9885368829-JPG.scr
IMG3725917220-JPG.zip
IMG1036360619-JPG.scr
invoice_23049713423423-23579324823dks.pdf.exe
New_Purchase_xls.zip
New_Purchase_xls.exe
Janna_photo_album_dbd.zip
Photo_163.JPG.zip.exe
To All Employees 2013.zip
To All Employees 2013.zip.exe
Deena_photo_album_9bc.zip
photo_album_jpg1173445205.zip.exe
IMG5046122327-JPG.zip
IMG2331921606-JPG.scr
IMG 0538547289.zip
IMG 0563890432.jpeg.exe
20131113_TIS0LU.zip
20131113_T9I4DD.pdf.exe
Deposito-123285370.zip
comprovante de deposito_DOC.scr
Angelina_photo_album_df9c4c.zip
photoJPG11759043876.zip.exe
Instagram Photo EB5933313535.zip
Instagram Photo DIG9048599868.jpeg.exe
message.zip
message.wav.exe<
IMG0403781585-JPG.zip
IMG1909573321-JPG.scr
Invoice.PDF.exe
Swift tt.pdf(1).zip
Swift tt.pdf.scr
P20131119-006599.zip
P20131119-002325.jpg.exe
To All Employees 2013.zip
To All Employees 2013.PDF.exe
IMG5554791739-JPG.zip
IMG3062468111-JPG.scr
ImageUploadedByTapatalk1107757889.208070.zip
ImageUploadedByTapatalk1002744930.133650.jpg.exe
Nota_fiscal-548527588.zip
Nota_fiscal_028848_DOC.scr
Voucher_89376H8376E36.zip
Voucher_89376H8376E36.pdf.scr
donation.pdf.zip
donation.pdf.exe
gallery_18998_5167_939148.zip
gallery_67904_1800_215532.jpg.exe
pyx_435542234_1_HNB.zip
pyx_435542234_1_HNB.exe
AE85BA3B70.zip
Skype_Message_ID37946478965872563287456871324816.wav
8600C3EEC0.zip
Skype_Voice_M_49756457635872963589732645872345.wav.exe
Skype_Voice_Message-9615E04139.zip
4323976457346598236456363249569234650923649562345.wav.exe
Skype_Voice_Message-BEC553E760.zip
724936475896346458762387456873468957632.wav.exe
Skype_Voice_Message-34E651A5A4.zip
Skype_ID_9423697463659825v52b394865b8324.wav.exe
IMG8089800434-JPG.zip
IMG3485167767-JPG.scr
DSC_0181(copy).jpg.zip
DSC_0181(copy).jpg.exe
ttcopy_fdp(2).zip
ttcopy?fdp.exe
IMG0300295492-JPG.zip
IMG2412867800-JPG.scr
IMG5694495044-JPG.zip
IMG2960638805-JPG.scr
IMG0577599060-JPG.zip
IMG1901707149-JPG.scr
Certificate.key.zip
AGENT27027444…Certificate.key_PFX.rar.exe
IMG8000406789-JPG.zip
IMG9302618923-JPG.scr
IMG0313023836-JPG.zip
IMG4740740578-JPG.scr
MG02-12-2013_726277.zip
IMG02-12-2013_006580.jpeg.exe
IMG7491341820-JPG.zip
IMG3814538629-JPG.scr
IMG4906981717-JPG.zip
IMG8873302354-JPG.scr
IMG9589620386-JPG.zip
IMG7951329594-JPG.scr
IMG9359236486-JPG.zip
IMG6122417334-JPG.scr
IMG0190688046-JPG.zip
IMG2204410652-JPG.scr
RoyalMail_ID_89C0684444.zip
Royal-Mail_Report_03485734895374895637249865238746532649573245.pdf.exe
RoyalMail_ID_100ABC898B.zip
RoyalMail-report_00002349823948694367856239587632497856932784658325.pdf.exe
fax.zip
fax.pdf.exe
Swift_PDF.zip
Swift_PDF.exe
FMS-Case-TNIW15E6DP2XF2R.zip
FMS-Case.exe
IMG.05.12.2013_510796.zip
IMG.05.12.2013_004311.jpeg.exe
eBay_ID627997ECA3.zip
Password_16523465_recovery2111.pdf.exe
eBay_ID525D28D369.zip
Password_3684986901_recovery.pdf.7657454875.pdf.exe
eBay_IDF49E3844AB.zip
Pasword_recovery_76253476238474.pdf.exe
IMG2903355202-JPG.zip
IMG1820784861-JPG.scr
servizi_telepass_formato_elettronico_TAGUQ66SRIBD0ZJ0.zip
servizi_telepass_formato_elettronico_84FGR6RGH9600FBC.pdf.exe
PostBank_November_2013_PDF.zip
Ihr Konto bei der Postbank wird eingeschr?nkt - #23498502-4-238036.exe
2013_12_17-65_11_91_my-images.zip
2013_12_17-14_18_14_my-images.JPG.exe
Shipping_xlsx.zip
Shipping_xlsx.scr
IMG2435881535-JPG.zip
IMG3271354919-JPG.scr
IMG2103535522-JPG.zip
IMG9344367585-JPG.scr
IMG7943742406-JPG.zip
IMG1832211531-JPG.scr
Court_Notice_Latham_and_Watkins__NY15467.zip
Court_Notice_Latham_and_Watkins__New_York.exe
Court_Notice_Latham_and_Watkins__NY03962.zip
payment slip000199Order882992002.pdf.zip
Payment000199Order882992002.pdf.exe
IMG9038936814-JPG.zip
IMG9038515615-JPG.scr
IMG0780739754-JPG.zip
IMG3089082076-JPG.scr
02_12_2014_Court_Notice_N#1299.zip
02_12_2014_Court_Notice_San_Francisco_USA.exe
IMG1494722996-JPG.zip
IMG5362043341-JPG.scr
IMG8528729325-JPG.zip
IMG3723118768-JPG.scr
Invoice_Confirmation_2014_01_PDF.zip
Invoice_Confirmation_2014_01_PDF.scr
IMG7443204710-JPG.zip
IMG2120220172-JPG.scr
IMG8514905368-JPG.zip
IMG1838439764-JPG.scr
Proforma invoice-pdf.zip
Proforma invoice-pdf.scr
USBank_December_2013_1825C1155A.zip
USBank - December 2013_ID39485394562093456309847589346598233427583450.pdf.exe
USBank_December_2013_253627215D.zip
USBank_December_2013_Report_4390785340572349087556234659873274958473295.pdf.exe
receipt.zip
receipt_9828485924203488889_239742348zzx.pdf.exe
receipt_239742034729492349_234992384dj.pdf.exe
invoice_91347293472937584_8239748239aa.pdf.exe
receipe.zip
receipe_293823092888422010_91489234234us.pdf.exe
02_2014_DSC_0181.zip
02_2014_DSC_8903.JPG.exe
GE937-PDF.exe
Foto_09_02_2014_IMG_990498.zip
Foto_09_02_2014_IMG_678054.jpeg.exe
IMG2329301805-JPG.zip
IMG6795681252-JPG.scr
Sibyl_60684.zip
Get_Photo_Set_Wallpaper_New_added_collection_part01.jpg.scr
IMG7072352801-JPG.zip
IMG6155573842-JPG.scr
photo4592.zip
photo4592.jpg.pif
297529MAIN_ROVER_RFI.zip
297529MAIN_ROVER_RFI.exe
Wage_Notification.zip
Invoice.pdf.scr
Revised PI_pdf.zip
achi (1).exe
DESPATCH_NOTE_539871.zip
disp_75464354787914325.doc.exe
CBE_Form.zip
CBE_Form.scr
IMG1744053193-JPG.zip
IMG2072334327-JPG.scr
Informazioni Riservate.PDF.zip
Informazioni Riservate.PDF.scr
_Fin_report_2205.zip
Fin_report_2205.xls.scr
report_92da3ec16736842.pdf.exe
771637.zip
Report_874353536957245.pdf.exe
694797.zip
_
>
> _ _

The invoice_389419201.pdf.exe in the _invoice.zip _attachment file has an approximate file size of 170,536 bytes. The MD5 checksum is not available. The IMG7862402593-JPG.scr file in the IMG6115429216-JPG.zip attachment has a file size of 18,432 bytes. The MD5 checksum is the following string: 0x8DE524CC43AB38824BB065CDAE50C302

The report.pdf.exe file in the report.zip attachment has a file size of 133,632 bytes. The MD5 checksum is the following string: 0x2AF6EDD8175E7B793AA0C015B0DC178E

The Confirming 874009485990.docx.exe file in the Confirming 416005738037.zip attachment has a file size of 49,877 bytes. The MD5 checksum is the following string: 0xD880CD5E3FE803C17F4208552EC22698

The sampl??fdp.exe file in the PO_List.pdf.zip attachment has a file size of 258,886 bytes. The MD5 checksum is the following string: 0x20A4C0DF713058AFBC4DFC0BC148A1E6

The image 1016_007499_005.jpeg.exe file in the image 1016_059625_675.zip attachment has a file size of 100,565 bytes. The MD5 checksum is the following string: 0xE54557C988CD00BB768221465131D28D

The IMG1831967145-JPG.scr file in the IMG1465905579-JPG.zip attachment has a file size of 7,168 bytes. The MD5 checksum is the following string: 0xFBC4D8178859E3DB6BE2F0AAA4576FD2

The IMG8158191843-JPG.scr file in the IMG1737005922-JPG.zip attachment has a file size of 7,168 bytes. The MD5 checksum is the following string: 0x4E56AEF4E97B2D48C16A33A2CD4FA425

The 17-10-2013 14_42_04.jpeg.exe file in the 17-10-2013 52_05_44.zip attachment has a file size of 82645 bytes. The MD5 checksum is the following string: 0x0458A01E42544EACF00E6F2B39B788E0

The IMG7617999738-JPG.scr file in the IMG0107656305-JPG.zip attachment has a file size of 7,168 bytes. The MD5 checksum is the following string: 0x063D887791DC320862013B06557978E5

The Fotos_Facebook_12548521_JPG.scr file in the Fotos_Facebook-718029896.zip attachment has a file size of 466,432 bytes. The MD5 checksum is the following string: 0x34EF33C8429511F6F406A09B57D5FFD5

A variant of the report.pdf.exe file in the report.zip attachment has a file size of 34,816 bytes. The MD5 checksum is the following string: 0xB21DA44100E18DB1E2B20ED94458CAD3

The packing-list.exe file in the packing-list.zip attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0x83F03A0E1BBDE3AC07546D0EDF603F90

The 2013 Ihre aktuelle Rechnung 9006459112.pdf.exe file in the catalog.rar attachment has a file size of 89,505 bytes. The MD5 checksum is the following string: 0x53C37A96C889C7030BE6DDECAEA64F36

The foto_image 22-10-2013.jpeg.exe file in the foto_image 22-10-2013 607.zip attachment has a file size of 287,445 bytes. The MD5 checksum is the following string: 0x98899FA0E6C23FF9C662F70635398954

The IMG7226578219-JPG.scr file in the IMG1783996440-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0x6ADD858127E0DC9D203D75EE13990A54

The IMG5676305001-JPG.scr file in the IMG4243329580-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0xE84852769B957505C331016513AE34F6

The_ 23-10-2013 13_64_09.jpeg.exe_ file in the 23-10-2013 24_88_85.zip attachment has a file size of 80,896 bytes. The MD5 checksum is the following string: 0x1F4F37B2F22C16EF0D4AB5A760CF1F15

The IMG1446633764-JPG.scr file in the IMG6624460956-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0x73CB8A21A4B1B89012F9CE300073A32A

The Extrato_multa_DOC.scr file in the Extrato_multas-551089129.zip attachment has a file size of 461,312 bytes. The MD5 checksum is the following string: 0x710A821413991824CCBDE0EEF8259CE4

The P.O 43215.JPEG.SCR file in the P.O 43215.JPEG.zip attachment has a file size of 1,094,959 bytes. The MD5 checksum is the following string: 0x6D0F736EAF1AF9C9FF61A16CACD51AF5

A third variant of the report.pdf.exe file in the report.zip attachment has a file size of 29,696 bytes. The MD5 checksum is the following string: 0x3B7A8772DA4F0579DF600BA284347642

The IMG2913638301-JPG.scr file in the IMG1810984147-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0x28EFA28AF6056F44655FACFC868CD8CF

The invoice_203519357-125mo.pdf.exe file in the_ invoice.zip_ attachment has a file size of 240,128 bytes. The MD5 checksum is the following string: 0x65A16A9E63613845C8FC23CA61A49405

The IMG4516776866-JPG.scr file in the IMG3331191846-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0x50FB8121036A06795C543FF8BC037289

The IMG4635208144-JPG.scr file in the IMG8354200653-JPG.zip attachment has a file size of 6,656 bytes. The MD5 checksum is the following string: 0x169EA70D2D079419D7F778090665E599

The New_Order_Quotation-pdf.exe file in the Data L Approval.zip attachment has a file size of 1,474,009 bytes. The MD5 checksum is the following string: 0xD2750C5752EDB52870D1B5479BAC8659

The hesperbot_info.exe file in the 52ba4f5ecec96fd6f958497e8713f09e.zip attachment has a file size of 385,024 bytes. The MD5 checksum is the following string: 0x52BA4F5ECEC96FD6F958497E8713F09E

The 28ottobre2013_98475003IMG.jpeg.exe file in the 28ottobre2013_98475003IMG.zip attachment has a file size of 268,952 bytes. The MD5 checksum is the following string: 0x8E58931870DEF6B48D435128E5247520

The 27_Oktober IMG_90085331.jpeg.exe file in the 27_Oktober IMG_28223894.zip attachment has a file size of 193,337 bytes. The MD5 checksum is the following string: 0x5D26F85B1C410ADFA836959C580F1670

The VOICEATT281043884333.WMA.exe file in the VOICEATT281043884333.WMA.zip attachment has a file size of 163,840 bytes. The MD5 checksum is the following string: 0x8AC76A3D341795890CB80358FC6FEE23

The P.O 412356.pdf.pif file in the P.O 412356.pdf.zip attachment has a file size of 1,062,461 bytes. The MD5 checksum is the following string: 0xD33D19EA8435A3C28EEAC1745DCAAF35

A fourth variant of the report.pdf.exe file in the report.zip attachment has a file size of 30,208 bytes. The MD5 checksum is the following string: 0x56598BF3CBF05965505220D1969CB522

The SCANNEDCHECK31102013.JPEG.exe file in the SCANNEDCHECK31102013.JPEG.zip attachment has a file size of 68,608 bytes. The MD5 checksum is the following string: 0x7F872AD7B6A7E67238CAFE3EB89A03E7

A fifth variant of the report.pdf.exe file in the report.zip attachment has a file size of 35,840 bytes. The MD5 checksum is the following string: 0xD5255F33D4A23BAC3961031A8C613E2F

The invoice_9103812-1232iq.pdf.exe file in the invoice.zip attachment has a file size of 236,544 bytes. The MD5 checksum is the following string: 0x5B02FD285B89F9E44086600C6EC12A30

The Scanned_Image.pdf.exe file in the Scanned_Image.pdf.zip attachment has a file size of 77,824 bytes. The MD5 checksum is the following string: 0x7FF1A92E3F641FE38B4C90DD8C52187A

The IMG1835129955-JPG.scr file in the IMG5518718145-JPG.zip attachment has a file size of 7,680 bytes. The MD5 checksum is the following string: 0x0CEBC270BFBEA9BE4D9813D40698A7AA

The invoice_891640125661_24691ao.pdf.exe file in the invoice.zip attachment has a file size of 233,472 bytes. The MD5 checksum is the following string: 0x9C4388064D701A6F0162356079D1C592

The P.O 750 MT-LLC.exe file in the P.O_26FP56.zip attachment has a file size of 800,688 bytes. The MD5 checksum is the following string: 0x9AC971DA4A25C1456C01E3346164E87D

The Bank__Payment__Confirmation__Receipt_pdf.exe file in the Bank__Payment__Confirmation__Receipt_pdf.zip attachment has a file size of 293,888 bytes. The MD5 checksum is the following string: 0x6337954329E3436FE2F342E8304DF0A9

The McAfee Reactivation Wizard.pdf.exe file in the McAfee Reactivation Wizard.zip attachment has a file size of 39,092 bytes. The MD5 checksum is the following string: 0x37737EE4C9344A3600D5463CA69726E0

The photo_album.zip.exe file in the Velma_photo_album_19fa1.zip attachment has a file size of 330,363 bytes. The MD5 checksum is the following string:0xF734216683C1AAD48D17C076EB804BDA

The IMG9315555649-JPG.scr file in the IMG6973932987-JPG.zip attachment has a file size of 9,216 bytes. The MD5 checksum is the following string: 0xAAC163257C04D6E9C42138F1BF15103D

The IMG9885368829-JPG.scr file in the IMG1359250380-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0x37C232BE80626B16C6CF5DF7BC24BB79

The IMG1036360619-JPG.scr file in the IMG3725917220-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0xF63E2BDF3F2A22AE544444BB25E4B047

The invoice_23049713423423-23579324823dks.pdf.exe file in the invoice.zip attachment has a file size of 223,744 bytes. The MD5 checksum is the following string: 0x929BA03A3447E72F67EFB4C4ADFFEBE9

The New_Purchase_xls.exe file in the New_Purchase_xls.zip attachment has a file size of 418,304 bytes. The MD5 checksum is the following string: 0x82227EBA549F18B7F5919B23173549B0

The Photo_163.JPG.zip.exe file in the Janna_photo_album_dbd.zip attachment has a file size of 212,793 bytes. The MD5 checksum is the following string: 0x0BD8A7CEB530A758C2FAE44C31866317

The To All Employees 2013.zip.exe file in the To All Employees 2013.zip attachment has a file size of 25,088 bytes. The MD5 checksum is the following string: 0xA98477BD24677519951F25695818D397

The photo_album_jpg1173445205.zip.exe file in the Deena_photo_album_9bc.zip attachment has a file size of 213,305 bytes. The MD5 checksum is the following string: 0xAF43EA0FC92EF858F0D86836C851DF08

The IMG2331921606-JPG.scr file in the IMG5046122327-JPG.zip attachment has an approximate file size of 8,990 bytes. The MD5 checksum is not available.

The IMG 0563890432.jpeg.exe file in the IMG 0538547289.zip attachment has a file size of 366,080 bytes.The MD5 checksum is the following string: 0x6A2905E94EABFF2D7793614D0B9F05BB

The 20131113_T9I4DD.pdf.exe file in the 20131113_TIS0LU.zip attachment has a file size of 214,329 bytes. The MD5 checksum is the following string: 0x89D44B7CDD6FF145F020942913568A1B

The comprovante de deposito_DOC.scr file in the Deposito-123285370.zip attachment has a file size of 473,600 bytes. The MD5 checksum is the following string: 0x76D46A1B2139CEF8F045643F50E34C36

A sixth variant of the report.pdf.exe file in the report.zip attachment has a file size of 50,176 bytes. The MD5 checksum is the following string: 0x65A2F525933C58199AF3C65C8D686838

The photoJPG11759043876.zip.exe file in the Angelina_photo_album_df9c4c.zip attachment has a file size of 226,617 bytes. The MD5 checksum is the following string: 0xEC43CD62348B2E01DA386A634F8BBAA5

The Instagram Photo DIG9048599868.jpeg.exe file in the_ Instagram Photo EB5933313535.zip_ attachment has a file size of 226,617 bytes. The MD5 checksum is the following string: 0xCE1505D2086E1ECC29EA44AB203E6A1C

The message.wav.exe file in the message.zip attachment has a file size of 11,776 bytes. The MD5 checksum is the following string: 0xE2EFF4AE2D4981240C95C454BD01A4E7

The IMG1909573321-JPG.scr file in the IMG0403781585-JPG.zip attachment has a file size of 10,752 bytes. The MD5 checksum is the following string: 0x74497EF1CA604F807146E82180C343A1

The Invoice.PDF.exe file in the Invoice.zip attachment has a file size of 12,288 bytes. The MD5 checksum is the following string: 0x64A27C2EEE6C3AD9E473776A0850D45E

A variant of the message.wav.exe file in the message.zip attachment has a file size of 12,288 bytes. The MD5 checksum is the following string: 0xB522EEF86294BB3EBD7B79EACEBCBB55

The Swift tt.pdf.scr file in the Swift tt.pdf(1).zip attachment has a file size of 567,697 bytes. The MD5 checksum is the following string: 0xB4ABA24D2566D91C8CB334386A288090

The P20131119-002325.jpg.exe file in the P20131119-006599.zip attachment has a file size of 22,553 bytes. The MD5 checksum is the following string: 0xA0A2FEA3FEED968E083EB380981798FB

The To All Employees 2013.PDF.exe file in the To All Employees 2013.zip attachment has a file size of 110,592 bytes. The MD5 checksum is the following string: 0x10225A89F5D76636AE95F3E61389E8E4

The IMG3062468111-JPG.scr file in the IMG5554791739-JPG.zip attachment has a file size of 12,800 bytes. The MD5 checksum is the following string: 0x0038785B7B592DA3B32F01CD0C75670B

The _ImageUploadedByTapatalk1002744930.133650.jpg.exe _file in the ImageUploadedByTapatalk1107757889.208070.zip attachment has a file size of 118,784 bytes. The MD5 checksum is the following string: 0x8D08D1DD080725122A67A79BB1938158

The Nota_fiscal_028848_DOC.scr file in the_ Nota_fiscal-548527588.zip_ attachment has a file size of 620,032 bytes. The MD5 checksum is the following string: 0x868843C6E68E88937941F14742AA87E8

The Voucher_89376H8376E36.pdf.scr file in the Voucher_89376H8376E36.zip attachment has a file size of 270,336 bytes. The MD5 checksum is the following string: 0x82368B758651D5971C6D15CFD13E4F34

The donation.pdf.exe file in the donation.pdf.zip attachment has a file size of 896,000 bytes. The MD5 checksum is the following string: 0x222FD0F3AA4324CF775CE8084B094685

The gallery_67904_1800_215532.jpg.exe file in the gallery_18998_5167_939148.zip attachment has a file size of 98,304 bytes. The MD5 checksum is the following string: 0xBFF8AF7432CED6E574E85D9241794F80

The pyx_435542234_1_HNB.exe file in the pyx_435542234_1_HNB.zip attachment has a file size of 24,576 bytes. The MD5 checksum is the following string: 0xF08F7633885FD0E2EC1D8307B168AB8F

The AE85BA3B70.zip file in the Skype_Message_ID37946478965872563287456871324816.wav attachment has a file size of 151,552 bytes. The MD5 checksum is the following string: 0x9E95A24EAA2D55B13731C14783EECAAC

The 8600C3EEC0.zip file in the Skype_Voice_M_49756457635872963589732645872345.wav.exe attachment has a file size of 151,552 bytes. The MD5 checksum is the following string: 0xDA05C58662D59287AF543728FD7E4A92

The 4323976457346598236456363249569234650923649562345.wav.exe file in the Skype_Voice_Message-9615E04139.zip attachment has a file size of 135,168 bytes. The MD5 checksum is the following string: 0xB1332E51739F613A4865DDBC8C72EC74

The 724936475896346458762387456873468957632.wav.exe file in the Skype_Voice_Message-BEC553E760.zip attachment has a file size of 135,168 bytes. The MD5 checksum is the following string: 0x030012AEFC1C6CB81BAF1023F7A0F81D

The Skype_ID_9423697463659825v52b394865b8324.wav.exe file in the Skype_Voice_Message-34E651A5A4.zip attachment has a file size of 135,168 bytes. The MD5 checksum is the following string: 0x0912940795F048526BC6FED8599A2317

The IMG3485167767-JPG.scr file in the IMG8089800434-JPG.zip attachment has a file size of 14,336 bytes. The MD5 checksum is the following string: 0xE03E34AB0FFEC79B51234D5D9D6929A8

The DSC_0181(copy).jpg.exe file in the DSC_0181(copy).jpg.zip attachment has a file size of 275,456 bytes. The MD5 checksum is the following string: 0xA6F7582902802D013853263C879E99E5

A third variant of the message.wav.exe file in the message.zip attachment has a file size of 11,776 bytes. The MD5 checksum is the following string: 0xA8739A84BA8B193DB7F8D8DC3C746950

The_ ttcopy?fdp.exe_ file in the ttcopy_fdp(2).zip attachment has a file size of 541,595 bytes. The MD5 checksum is the following string: 0x37C1DF291D9B3C33B5CD72F926665702

The IMG2412867800-JPG.scr file in the IMG0300295492-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0xF2840173C4DA89CEBFBA388A5AAA4335

The IMG2960638805-JPG.scr file in the IMG5694495044-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0xC2D88356B7033638C8E760AE3E6BE82D

The IMG1901707149-JPG.scr file in the IMG0577599060-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0x37DB2B57D45C17EAF18BFBADF61A0617

The AGENT27027444…Certificate.key_PFX.rar.exe file in the Certificate.key.zip attachment has a file size of 348,160 bytes. The MD5 checksum is the following string: 0x14A338ED0B9C92AC345C9DFB81DFD965

The IMG9302618923-JPG.scr file in the_ IMG8000406789-JPG.zip_ attachment has a file size of 177,152 bytes. The MD5 checksum is the following string: 0x44E049A5133C5993D274BEB1B2ACDD76

The IMG4740740578-JPG.scr file in the IMG0313023836-JPG.zip attachment has a file size of 10,752 bytes. The MD5 checksum is the following string: 0x70D5BFFE99EC1FEF716E26AC398BC69C

The _IMG02-12-2013_006580.jpeg.exe _file in the MG02-12-2013_726277.zip attachment has a file size of 291,942 bytes. The MD5 checksum is the following string: 0x11E5C8B48F4BC3BDB6E17474B7361C33

The IMG3814538629-JPG.scr file in the IMG7491341820-JPG.zip attachment has a file size of 9,728 bytes. The MD5 checksum is the following string: 0x68C4A469DE2F547DD468B154775FC759

The_ IMG8873302354-JPG.scr_ file in the IMG4906981717-JPG.zip attachment has a file size of 10,240 bytes. The MD5 checksum is the following string: 0x5CB9DA35D7EC063F46479171033FA7C2

The IMG7951329594-JPG.scr file in the IMG9589620386-JPG.zip attachment has a file size of 9,728 bytes. The MD5 checksum is the following string: 0xB3E7A2ACE721BF1D1A58572C21D023A1

The _IMG6122417334-JPG.scr _file in the IMG9359236486-JPG.zip attachment has a file size of 9,728 bytes. The MD5 checksum is the following string: 0xAC88A9147B1BEBDC1CDEB2D8F18C373F

The IMG2204410652-JPG.scr file in the IMG0190688046-JPG.zip attachment has a file size of 9,728 bytes. The MD5 checksum is the following string: 0x0DDB2C0F729570699DA9086F15E08E10

The Royal-Mail_Report_03485734895374895637249865238746532649573245.pdf.exe file in the RoyalMail_ID_89C0684444.zip attachment has a file size of 82,233 bytes. The MD5 checksum is the following string: 0x4948180CFBA94088861E24733D393C9C

The RoyalMail-report_00002349823948694367856239587632497856932784658325.pdf.exe file in the RoyalMail_ID_100ABC898B.zip attachment has a file size of 90,734 bytes. The MD5 checksum is the following string: 0x5E13562E8BA0EA061B74D4A37A6DA859

The fax.pdf.exe file in the fax.zip attachment has a file size of 77,824 bytes. The MD5 checksum is the following string: 0xCCDEE5A9EB64BFC3A701843474AA5C3C

The Swift_PDF.exe file in the_ Swift_PDF.zip _attachment has a file size of 916,554 bytes. The MD5 checksum is the following string: 0x7C484339FF058373160811BA4A1658CB

The _FMS-Case.exe _file in the FMS-Case-TNIW15E6DP2XF2R.zip attachment has a file size of 18,432 bytes. The MD5 checksum is the following string: 0x67C863E23FF97A3AB4CFEB251434394C

The IMG.05.12.2013_004311.jpeg.exe file in the_ IMG.05.12.2013_510796.zip_ attachment has a file size of 285,184 bytes. The MD5 checksum is the following string: 0xB7ECE9F75EFC377F065CDF7FD77C38A1

The Password_16523465_recovery2111.pdf.exe file in the eBay_ID627997ECA3.zip attachment has a file size of 86,016 bytes. The MD5 checksum is the following string: x583AFAC19BE070B82CAB7AC90C309667

The Password_3684986901_recovery.pdf.7657454875.pdf.exe file in the eBay_ID525D28D369.zip attachment has a file size of 126,976 bytes. The MD5 checksum is the following string: 0xA3CE937747598904D15FE86C2361D934

The Pasword_recovery_76253476238474.pdf.exe file in the eBay_IDF49E3844AB.zip attachment has a file size of 86,329 bytes. The MD5 checksum is the following string: 0x3E6ED48B6CD0D1C7DDE341C3344E777C

The IMG1820784861-JPG.scr file in the IMG2903355202-JPG.zip attachment has a file size of 15,360 bytes. The MD5 checksum is the following string: 0x07A1A6AF90033276427647F7FDE27260

The servizi_telepass_formato_elettronico_84FGR6RGH9600FBC.pdf.exe file in the servizi_telepass_formato_elettronico_TAGUQ66SRIBD0ZJ0.zip attachment has a file size of 286,521 bytes. The MD5 checksum is the following string: 0x16CE2D99F60DE7C14BBAC23086681EAC

The Ihr Konto bei der Postbank wird eingeschr?nkt - #23498502-4-238036.exe file in the PostBank_November_2013_PDF.zip attachment has a file size of 114,176 bytes. The MD5 checksum is the following string: 0xF5776DA9618C2CCFFD46AF4FF77CD01A

The 2013_12_17-14_18_14_my-images.JPG.exe file in the 2013_12_17-65_11_91_my-images.zip attachment has a file size of 215,677 bytes. The MD5 checksum is the following string: 0x33453E3EF8E2BA3DA4A2F92363BE2CCB

The _Shipping_xlsx.scr _file in the Shipping_xlsx.zip attachment has a file size of 949,031 bytes. The MD5 checksum is the following string: 0x4394D55D3593ACDF81FEF223BAD37254

The IMG3271354919-JPG.scr file in the_ IMG2435881535-JPG.zip_ attachment has a file size of 16,384 bytes. The MD5 checksum is the following string: 0x4A99268A210167B2C8DFCDE65DB6A2C0

The IMG9344367585-JPG.scr file in the IMG2103535522-JPG.zip attachment has a file size of 7,680 bytes. The MD5 checksum is the following string: 0xC12BD035AD7314D9BB62BB135AD26CEC

The IMG1832211531-JPG.scr file in the IMG7943742406-JPG.zip attachment has a file size of 14,848 bytes. The MD5 checksum is the following string: 0xABE380A4793EFC8A454174CD521692CD

The Court_Notice_Latham_and_Watkins__New_York.exe file in the Court_Notice_Latham_and_Watkins__NY15467.zip attachment has a file size of 123,904 bytes. The MD5 checksum is the following string: 0xAC572CA741DF1BBCC88183E27E7FCE6C

A variant of the Court_Notice_Latham_and_Watkins__New_York.exe file in the Court_Notice_Latham_and_Watkins__NY03962.zip attachment has a file size of 125,440 bytes. The MD5 checksum is the following string: 0x5C52A91C9C89FF4724603C6C87B184B9

The Payment000199Order882992002.pdf.exe file in the_ payment slip000199Order882992002.pdf.zip_ attachment has a file size of 867,783 bytes. The MD5 checksum is the following string: 0x81601529524C4729A0A1A6FFEFAB81EB

The IMG9038515615-JPG.scr file in the IMG9038936814-JPG.zip attachment has a file size of 17,920 bytes. The MD5 checksum is the following string: 0xD0E1F4F846B2D168D3E47BD12171BA6D

The IMG3089082076-JPG.scr file in the IMG0780739754-JPG.zip attachment has a file size of 18,432 bytes. The MD5 checksum is the following string: 0x301C794B5956D861850699C40C131339

The 02_12_2014_Court_Notice_San_Francisco_USA.exe file in the 02_12_2014_Court_Notice_N#1299.zip attachment has a file size of 118,272 bytes. The MD5 checksum is the following string: 0x4B899907BD0833455AB99466DD1C77BB

The IMG5362043341-JPG.scr file in the_ IMG1494722996-JPG.zip_ attachment has a file size of 17,920 bytes. The MD5 checksum is the following string: 0xF63A623357017C4FCD282B03536484D1

The IMG3723118768-JPG.scr file in the_ IMG8528729325-JPG.zip_ attachment has a file size of 19,968 bytes. The MD5 checksum is the following string: 0xEA7A7D35EB9F8650D8AC0BC6A90BD622

The Invoice_Confirmation_2014_01_PDF.scr file in the Invoice_Confirmation_2014_01_PDF.zip attachment has a file size of 209,296 bytes. The MD5 checksum is the following string: 0xB68D987E356093477ABA8196DC988172

The IMG2120220172-JPG.scr file in the IMG7443204710-JPG.zip attachment has a file size of 16,384 bytes. The MD5 checksum is the following string: 0x585F57A8A7BAD769434509738AC49F12

The IMG1838439764-JPG.scr file in the IMG8514905368-JPG.zip attachment has a file size of 17,920 bytes. The MD5 checksum is the following string: 0xA57F5453F589D09B83EB33D03C49AF65

The Proforma invoice-pdf.scr file in the Proforma invoice-pdf.zip attachment has a file size of 599,952 bytes. The MD5 checksum is the following string: 0x01ECC474570FDBD80DE7E6E9C2EBE4E7

The USBank - December 2013_ID39485394562093456309847589346598233427583450.pdf.exe file in the USBank_December_2013_1825C1155A.zip attachment has a file size of 100,153 bytes. The MD5 checksum is the following string: 0x2089EAC526883C98D67D399449B461DB

The USBank_December_2013_Report_4390785340572349087556234659873274958473295.pdf.exe file in the USBank_December_2013_253627215D.zip attachment has a file size of 100,153 bytes. The MD5 checksum is the following string: 0xA381D49E6F2B23296FA00AA681218E8A

The receipt_9828485924203488889_239742348zzx.pdf.exe file in the receipt.zip attachment has a file size of 86,963 bytes. The MD5 checksum is the following string: 0x9E55425FF1C31E8AD7237DEA6D5EC738

The receipt_239742034729492349_234992384dj.pdf.exe file in the receipt.zip attachment has a file size of 105,464 bytes. The MD5 checksum is the following string: 0x0B1798DCA8808DD1E4B8B8D55BDCD51B

The invoice_91347293472937584_8239748239aa.pdf.exe file in the invoice.zip attachment has a file size of 100,862 bytes. The MD5 checksum is the following string: 0x490C47B5F142716119DBF822236C487E

The receipe_293823092888422010_91489234234us.pdf.exe file in the receipe.zip attachment has a file size of 106,139 bytes. The MD5 checksum is the following string: 0xFEB89D4CA321A32D233021FDC934FA91

The _02_2014_DSC_8903.JPG.exe _file in the _02_2014_DSC_0181.zip _attachment has a file size of 40,960 bytes. The MD5 checksum is the following string: 0x476E333DA2BF217E84C8C322AEF48ABA

The GE937-PDF.exe file in the_ Fax.zip_ attachment has a file size of 1,277,485 bytes. The MD5 checksum is the following string: 0x91401C3AC2CD1908B2DB3000958B2335

The Foto_09_02_2014_IMG_678054.jpeg.exe file in the Foto_09_02_2014_IMG_990498.zip attachment has an approximate file size of 64,542 bytes. The MD5 checksum is the following string: 673fd4bc78f99b70da4a8f54258e7542

The IMG6795681252-JPG.scr file in the IMG2329301805-JPG.zip attachment has a file size of 15,872 bytes. The MD5 checksum is the following string: 0x515CE622253371719EA7957F5304F4C5

The Get_Photo_Set_Wallpaper_New_added_collection_part01.jpg.scr file in the Sibyl_60684.zip attachment has a file size of 65,536 bytes. The MD5 checksum is the following string: 0xC9416D9967AC02C67062B6A36366B8CD

The IMG6155573842-JPG.scr file in the_ IMG7072352801-JPG.zip_ attachment has a file size of 15,872 bytes. The MD5 checksum is the following string: 0x12BFAE5146D3920167D5B0B3F3C05006

A variant of the fax.pdf.exe file in the fax.zip attachment has a file size of 21,504 bytes. The MD5 checksum is the following string: 0x3E69C0A814B468D9DE62264134486518

The photo4592.jpg.pif file in the photo4592.zip attachment has a file size of 116,736 bytes. The MD5 checksum is the following string: 0x7B0BBD83E40A07079DB241C55F859445

The 297529MAIN_ROVER_RFI.exe file in the_ 297529MAIN_ROVER_RFI.zip_ attachment has a file size of 389,596 bytes. The MD5 checksum is the following string: 0x252BAB6DC5BFC096B2DE4697DE24452B

The Wage_Notification.pdf.exe file in the _Wage_Notification.zip _attachment has a file size of 16,384 bytes. The MD5 checksum is the following string: 0xD2CBF05D928EA39B17A4FC3563B6A5E6

The Invoice.pdf.scr file in the Invoice.zip attachment has a file size of 831,488 bytes. The MD5 checksum is the following string: 0x159A4DDAF5285E5B35F9780416B0385C

The achi (1).exe file in the Revised PI_pdf.zip attachment has a file size of 249,825 bytes. The MD5 checksum is the following string: 0x745476116929BB868BB9787A7C4AE1D7

The disp_75464354787914325.doc.exe file in the DESPATCH_NOTE_539871.zip attachment has a file size of 100,712 bytes. The MD5 checksum is the following string: 0xE11DD856927286E85AC77DD088DD6378

The _CBE_Form.scr _file in the CBE_Form.zip attachment has a file size of 18,432 bytes. The MD5 checksum is the following string: 0x20406804C43D11DA25ABC2714697EC59

The_ IMG2072334327-JPG.scr_ file in the _IMG1744053193-JPG.zip _attachment has an approximate file size of 1,157 bytes. The MD5 checksum is not available.

A third variant of the fax.pdf.exe file in the fax.zip attachment has a file size of 18,432 bytes. The MD5 checksum is the following string: 0x34B75884423EE62DD442F84E3050F467

The Informazioni Riservate.PDF.scr file in the Informazioni Riservate.PDF.zip attachment has a file size of 544,768 bytes. The MD5 checksum is the following string: 0x49EE55B98146130F73FB3CCF0AB3F4

The Fin_report_2205.xls.scr file in the Fin_report_2205.zip attachment has a file size of 110,592 bytes. The MD5 checksum is the following string: 0xA9CD3C4B3952DC401D4A9277ED20AD6E

The report_92da3ec16736842.pdf.exe file in the 771637.zip attachment has a file size of 94,208 bytes. The MD5 checksum is the following string: 0x3B53E958ECF15865ADA5A370D5E79DF0

The Report_874353536957245.pdf.exe file in the 694797.zip attachment has a file size of 114,688 bytes. The MD5 checksum is the following string: 0xDF11E3121380D85D75484728064AADD0

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: Payroll Invoice

Message Body:

ADP TotalSource
A copy of your ADP TotalSource Payroll Invoice for the following payroll is is attached in PDF file and available for viewing.
Year: 13
Week No: 08
Payroll No: 1
Please open attached file to view and check following payrol
This email was generated by an automated notification system. If you have any questions regarding the invoice or you have misplaced your
MyTotalSource login information, please contact your Payroll Service Representative. Please do not reply to the email directly.
© 2007 Automatic Data Processing, Inc.

Or

> Subject: Tell me what you think of this picture

Message Body:

;D

Or

> Subject: Wells Fargo Advisors

Message Body:

Please review attached documents.
Jeff_Parker
Wells Fargo Advisors
817-559-4662 office
817-358-9011 cell [email protected]
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC.
1 North Jefferson, St. Louis, MO 63103
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.

Or

> Message Body:

Account Number : 220820360077
I’m writing to confirm that you have agreed to take up our fantastic 5 GBP off Line Rental (14.50GBP) for 12 Mo nths With Broadband Unlimited (Recontract) - Existing UK Customer. We also wanted to remind you that as part of this, you’ve agreed to re-subscribe to the products listed in the table below for a further 12 month minimum term , starting from the date shown below:
Subscription Contract Start Date
Sky Broadband10/15/2013
Sky Talk 10/15/2013
Sky Line Rental 10/15/2013
If you cancel or stop paying for your subscription(s) before the end of the minimum term (other than where you have a right to do so under your con tract), we may charge you early termination charges. These will be based o n the amount of subscription payments due for the remainder of your minimum term less any costs we save, including the cost of no longer providing you with the service. We will give you reasonable notice in writing before mak ing any charge.
We’re sure that you’ll continue to enjoy all the great services that Sky offer - if you need any further help, please visit sky.com/help.
The Sky Team

Or

> Message Body:

Subject: Re: Purchase Order/Product List Attached pls check and revert back to us.
Hi,
After checking your catalog, we find some product that we need in our
company for our market, we have attached our list of product for your
checking and please get back to me with your good price list after
checking our attached list.
Marketing Manager
Regards,
Mr Yorem Safar
Yesi Industries Ltd

Or

> Subject: MOL B/L FOR PROOFING PURPOSE - 13802848594 - MLW/0033N

Message Body:

Your shipment done so I am sending you Invoice & Packing List.
Plz. check the attached Invoice & Packing List.
Thanks With Regards,
Kashifa Ansari
(Asst. Manager export)

Or

> Subject: f531ab0332f85c4f79c2f46569100936

Message Body:

TELEKOM - ERLEBEN, WAS VERBINDET.
| Rechnungen speichern | Kennwort wiederherstellen
Mehr
|
Ihre Rechnung für November 2013
Guten Tag,
mit dieser E-Mail erhalten Sie Ihre aktuelle Rechnung. Die Gesamtsumme im Monat November 2013 beträgt: 57,96 Euro.
Den aktuellen Einzelverbindungsnachweis – sofern von Ihnen beauftragt – und das Rechnungsarchiv finden Sie im Kundencenter.
Diese E-Mail wurde automatisch erzeugt. Bitte antworten Sie nicht dieser Absenderadresse. Bei Fragen zu RechnungOnline nutzen Sie unser Kontaktformular.
Informationen über die Umstellung auf den einheitlichen Euro-Zahlungsverkehrsraum (SEPA) finden Sie hier.
Speziell für Sie: Möchten Sie zukünftig Informationen über neue Produkte und Tarife erhalten, melden Sie sich zu unserem kostenlosen Informationsservice an.
Mit freundlichen Grüßen
Ralf Hoßbach
Leiter Kundenservice
RechnungOnline aufrufen
Rechnungen im Mediencenter speichern
Rechnungen im Mediencenter speichern
Nie mehr in Schubladen kramen: Speichern Sie Rechnungen und Einzelverbindungsnachweise dauerhaft im Mediencenter – per Mausklick! Aus dem Kundencenter heraus benötigen Sie nämlich nur einen Klick, um Ihre Rechnungen ins Mediencenter zu übertragen.
So sparen Sie sich viel Papierkram und langwieriges Suchen. Aktenordner ade!
Jetzt informieren!
Persoenliches Kennwort wiederherstellen
Persönliches Kennwort wiederherstellen
Sie wollen Ihren Router neu konfigurieren, aber haben Ihr persönliches Kennwort vergessen? Kein Problem! Im Kundencenter können Sie Ihr Kennwort ab sofort einfach und schnell selbst wiederherstellen.
Denken Sie bei der Wahl von Kennwörtern immer an die Sicherheit: Bilden Sie Buchstaben-Zahlen-Kombinationen mit Sonderzeichen.
Jetzt informieren!
Weitere aktuelle Produkt- und Service-Informationen finden Sie in unserer Online-Rechnungsbeilage.
© Telekom Deutschland GmbH Kundencenter FAQ Kontakt AGB Impressum
Hinweis: Die Inhalte dieser Mail sind vertraulich und nur für den konkret genannten Adressaten der Anlage bestimmt. Falls Sie nicht der richtige Empfänger dieser E-Mail sind, senden Sie uns bitte eine Information an [email protected] und löschen Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser E-Mail und der darin enthaltenen Informationen sind nicht gestattet.

Or

> Message Body:

Sent from my iPhone

Or

> Subject: Picture of you??

Message Body:

:)

Or

> Subject: Is this you??

Message Body:

:D

Or

> Message Body:

MMS empfangen - auch per E-Mail
Bis zu 1000 Zeichen Text je MMS
E-Mailadressen oder ins Telekom Festnetz bis 300 KB
Der Empfang von Foto und Video MMS im Inland ist kostenlos. Wenn Sie eine MMS an eine E-Mail senden, erhält der Empfänger eine E-Mail mit Anhang2). Falls der Empfänger kein MMS-fähiges Handy besitzt, kann er Ihre Nachricht auf der Website www.mms.t-mobile.de abholen und auch weiterleiten2). Den nötigen Link und das individuelle Passwort auf der Website erhält er per SMS.

Or

> Subject: You should take a look at this picture

Message Body:

;)

Or

> Subject: Entrega de sua carteira de motorista.

Message Body:

Por motivo de perda de 21 pontos ou mais no prazo de 12 meses, conforme extrato de multa em anexo. Informamos que sua Carteira Nacional de Habilitação se encontra suspensa em nosso sistema.
Pedimos ao Sr(ª) comparecer no endereço da agência do Detran em anexo para efetuar a entrega de sua carteira de motorista no prazo de 10 dias a contar do recebimento dessa notificação.
Departamento Nacional de Transito (DETRAN)

Or

> Message Body:

HelloPlease do kindly acknowledge our order and please issue your PI asap.Also on your proforma invoice,do clearly state your possible delivery time for attached orderKindly send your direct contact mobile number with company addressI await your response
Thanks rgds
Miss kaluka

Or

> Subject: Payroll Invoice

Message Body:

ADP TotalSource
A copy of your ADP TotalSource Payroll Invoice for the following payroll is is attached in PDF file and available for viewing.
Year: 13
Week No: 08
Payroll No: 1
Please open attached file to view and check following payrol
This email was generated by an automated notification system. If you have any questions regarding the invoice or you have misplaced your
MyTotalSource login information, please contact your Payroll Service Representative. Please do not reply to the email directly.
© 2013 Automatic Data Processing, Inc.

Or

> Message Body:

see the information
Regards
Angela

Or

> Message Body:

numero: 335184062
MMS / mail / messaggi vocali

Or

> Subject: Foto 27_Oktober IMG_20550230

Message Body:
**
MMS / Mail / Sprachnachricht

Sent from my iPhone**

Or

> Subject: Voice Mail Message (4 seconds)

Message Body:

This voice message was created by Avaya Modular Messaging. To listen to this voice message,just open it.

Or

> Message Body:

Hello
Please do kindly acknowledge our order and please issue your PI asap.
Also on your proforma invoice,do clearly state your possible delivery time for attached order
Kindly send your direct contact mobile number with company address
I await your response
Thanks rgds
Mr Christopher

Or

> Subject: Wells Fargo Advisors

Message Body:

Please review attached documents.
John_Kirston
Wells Fargo Advisors
817-559-4662 office
817-358-9011 cell [email protected]
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC.
1 North Jefferson, St. Louis, MO 63103
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you.

Or

> Subject: FW: Check copy

Message Body:

We had problems processing your latest check, attached is a image copy.
Erik Graves
Wells Fargo Check Processing Services
817-073-7945 office
817-775-9295 cell
[email protected]
Wells Fargo Check Processing Services. 1 North Jefferson, St. Louis, MO
63103
CONFIDENTIAL NOTICE: The contents of this message, including any
attachments, are confidential and are intended solely for the use of the
person or entity to whom the message was addressed. If you are not the
intended recipient of this message, please be advised that any
dissemination, distribution, or use of the contents of this message is
strictly prohibited. If you received this message in error, please notify
the sender. Please also permanently delete all copies of the original
message and any attached documentation. Thank you.

Or

> Subject: Wells Fargo Advisors

Message Body:

**Please review attached documents.
Patric_Kings
Wells Fargo Advisors
817-559-4662 office
817-358-9011 cell [email protected]
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC.
1 North Jefferson, St. Louis, MO 63103
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed. If you are not the intended recipient of this message, please be advised that any dissemination, distribution, or use of the contents of this message is strictly prohibited. If you received this message in error, please notify the sender. Please also permanently delete all copies of the original message and any attached documentation. Thank you. **

Or

> Message Body:

Please open the attached document. This document was digitally sent to you
using an HP Digital Sending device (ID:25307)
–––––––––––––––––––––––––––––––––––––-
––
This email has been scanned for viruses and spam.
–––––––––––––––––––––––––––––––––––––-
––
Fri, 01 Nov 2013 15:21:27 +0500

Or

> Subject: My private photo

Message Body:

:P

Or

> Message Body:

Dear Sir
Attached herewith is our companies order for 2014/15
kindly arrange pi for the same
we await your early response
sales manager
jack chen
Global Category sales Manager
pr
Knowles Sound
Solutions???
Knowles Electronics (Beijing) Co., Ltd.
???
???20·, Beijing-Technological Development Area,
china 100176 - 16??·,100176
Tel: +86 10 5909 0516, Fax: +86 10 5909 0501, Mobile: +86 189 1073 6608
********** DISCLAIMER - tcixps.com********
Contents of this email (including any attachments) are intended only for the named addressee(s). It contains confidential information and is protected by law. Unless you are the named addressee (or authorized to receive this email by the named addressee) you must not copy, use or disclose any of its contents. If you are not the intended recipient, we request that you please notify us by reply email and destroy all copies of the message and any attachments. Thank you for your cooperation.
********** DISCLAIMER - tcixps.com**********
Contents of this email (including any attachments) are intended only for the named addressee(s). It contains confidential information and is protected by law. Unless you are the named addressee (or authorized to receive this email by the named addressee) you must not copy, use or disclose any of its contents. If you are not the intended recipient, we request that you please notify us by reply email and destroy all copies of the message and any attachments. Thank you for your cooperation.**

Or

> Message Body:

Hello,
The attached payment advice is issued at the request of our customer. The
payment was made to your company account. Please check the attachment.
Yours faithfully,
Danny Swag

Or

> Subject: McAfee Always On Protection Reactivation

Message Body:

Dear customer,
This email confirms that your Always On Protection has been cancelled for McAfee Internet Security,3-User McAfee Internet Security,3-User McAfee Internet Security.
Always On Protection ensures that your computer security protection is always up-to-date by automatically renewing your license annually. Without the Always On Protection feature, your PC will not be up-to-date as soon as your subscription expires.
If you want to reactivate the Always On Protection feature so there’s no lapse in your McAfee security, simply
open attached file with reactivation wizard.
Please do not reply to this email. Thank you.
Sincerely,
The McAfee Team
For all of your Customer Service and Technical Support needs, please visit the following link:
==> http://service.mcafee.com
View our privacy policy:
==> http://us.mcafee.com/root/aboutUs.asp?id=privacy
McAfee and/or other noted McAfee related products contained herein are registered trademarks or trademarks of McAfee, Inc., and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. Any other non-McAfee related products, registered and/or unregistered trademarks contained herein is only by reference and are the sole property of their respective owners.
© 2013 McAfee, Inc. All Rights Reserved.

Or

> Message Body:

How is it going? I’m Velma! i look for a second half.
I enjoy travelling and drawing! Look at my photos in attached file.
Answer me! Bye!

Or

> Subject: I just can’t belive this

Message Body:

hahaha

Or

> Subject: Take a look at my new picture please

Message Body:

;D

Or

> Subject: My private photo

Message Body:

:)

Or

> Subject: foto 12 november

Message Body:

--Von meinem iPhone gesendet

Or

> Subject: Unpaid Invoice #0846478

Message Body:

Please see attached copy (Invoice_0846478) of the original invoice.

Or

> Message Body:

Regards
Trish Brewin
Care Co-ordinator
Bunbury
Care Agency Est 1968
everybody needs somebody
Carers . Companions
Nannies . Mother’s Help . Maternity Nurses . Au Pairs
Housekeepers . Domestics . Housekeeper Couples
Residential . Daily . Temporary . Permanent
Nationwide
The Family Agency
58a High Street
Tarporley
Cheshire, CW6 0AG
Tel: 01829 730 201
Fax: 01829 730 843
Email: [email protected]
www.bunburyagency.com

Or

> Message Body:

Please check the attachment regarding the t.t copy.
Please note, below is payment detail :
Last Inv. : USD 32,000.00
We already t.t the USD 32,000.00 for you at 28.10.2013.
Please Run download to view the copy & sign this statement then confirm back by email.
Thank you.
Regards
Huong ( Ms. )
BRANCH OF JUKI SINGAPORE PTE LTD
Address: IOC Building No 254, F1-R05 Monivong Blvd,
S/K Beoung Rang, Khan Daun Penh,Phnom Penh,Cambodia.
Tel: (+855) 23 223 808

Or

> Subject: image 19 11 2013

Message Body:

- Sent from my iPhone

Or

> Subject: To all Employees - Confidential Message (id: 224851740)

Message Body:

DocuSign Logo
Your document has been completed
Sent on behalf of [email protected].
All parties have completed the envelope ‘Please DocuSign this document: To All Employees 2013.doc’.
To view or print the document download the attachment .
(self-extracting archive, Adobe PDF)
This document contains information confidential and proprietary to synergistichealthcare.com
LEARN MORE: New Features | Tips & Tricks | Video Tutorials
DocuSign. The fastest way to get a signature.
If you have questions regarding this notification or any enclosed documents requiring your signature, please contact the sender directly. For technical assistance with the signing process, you can email support.
This message was sent to you by [email protected] who is using the DocuSign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.

Or

> Subject: Congratulations you are a winner

Message Body:

Congratulation We are donating £800,000.00 GBP from Gareth & Catherine Donation Bull Fund ,a charitable organisation group discorvered by Britains Multi millionaires , for claims send in a reply your Full-name , Age, Phone Number, Country . View attachment for proof of donation.
Sincerely,
President -Gareth & Catherine Bull.

Or

> Subject: no subject

Message Body:

Sender: 07572418958
Message: Sending a reply:
You can reply by email to this mobile number within the next 7 days.
< only include attachments in jpeg or wav format.
< The total message size should not exceed 300kb.
< You can only reply once, and it must be within 7 days of receiving this message.

Or

> Message Body:

**Good Morning Sir,
We couldn’t complete the payment in our last invoice due to the error in the swift code in your account,my bank informed me that the mistake is from your side .
I have the attached the bank slip and our Invoice, please check it well and make sure it is your company account that is there, before the payment today.
Waiting for your urgent confirmation,
Regards,
Foong ( account department )
**

Or** **

> Message Body:

Dear Sir,
Your shipment done so I am sending you Invoice & Packing List.
Plz. check the attached Invoice & Packing List.
Thanks With Regards,
Kashifa Ansari

Or

> Subject: Urgent court notice No#86845

Message Body:

**Notice of appearance,
Hereby you are informed that you are due in the court of New York
on the 11 of January, 2014 at 10:00 am for the hearing of your case.
You are kindly asked to prepare and bring the documents relating to the case to Court on the specified date.
Please, download the copy of the court notice attached herewith to read the details.
Note: The case may be heard by the judge in your absence if you do not come.
Yours truly,
Miller Cook
Clerk to the Court.
**

Or

> Subject: 06fda25197eefe7cbf1fa330b2958830

Message Body:

**ADP TotalSource
A copy of your ADP TotalSource Payroll Invoice for the following payroll is is attached in PDF file and available for viewing.
Year: 13
Week No: 08
Payroll No: 1
Please open attached file to view and check following payrol
This email was generated by an automated notification system. If you have any questions regarding the invoice or you have misplaced your
MyTotalSource login information, please contact your Payroll Service Representative. Please do not reply to the email directly.
© 2013 Automatic Data Processing, Inc.
**

Or

> Subject: Electronic Invoice and Billing Information for FC5790

Message Body:

Please find attached your May Invoice and, if you have requested them, additional reports relating to the call and line charges on this bill.
Don’t Forget - We provide a host of other products and services including:
Telephone Systems & Maintenance (both traditional and VoIP)
Office Cabling (Cat5)
IT Support & Maintenance, IT Equipment & Installation
Cloud Computing, Hosted Solutions, Data Backup & Antivirus
Broadband, FTTC, EFM, MPLS & Leased Lines
Mobile Phones & Mobile Broadband
Non-Geographic Numbers (0800, 0845, 0844, 0871)
Inbound and Call Centre Solutions
Web Design & Hosting, Search Engine Optimisation (SEO)
Gas & Electricity Procurement
If you have any problems opening the file(s), or would like to discuss your bill, please call us or reply to this email.
Kind Regards,
Focus Billing.

> > > > Cisco Security analysts examine real-world email traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global email security threats and trends. Cisco will continue to monitor this threat and automatically adapt systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.

Cisco security appliances protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Email that is managed by Cisco and end users who are protected by Cisco Web Security Appliances will not be impacted by these attacks. Cisco security appliances are automatically updated to prevent both spam email and hostile web URLs from being passed to the end user.

Related Links
Cisco Security
Cisco SenderBase Security Network

Revision History

* Version	Description	Section	Date
61	Cisco Security has detected significant activity on June 11, 2014.		2014-June-12 12:44 GMT
60	Cisco Security has detected significant activity on May 22, 2014.		2014-May-23 12:24 GMT
59	Cisco Security has detected significant activity on April 4, 2014.		2014-April-07 13:43 GMT
58	Cisco Security has detected significant activity on March 31, 2014.		2014-April-01 11:43 GMT
57	Cisco Security has detected significant activity on February 25, 2014.		2014-March-26 13:35 GMT
56	Cisco Security has detected significant activity on February 21, 2014.		2014-February-24 14:04 GMT
55	Cisco Security has detected significant activity on February 18, 2014.		2014-February-19 14:46 GMT
54	Cisco Security has detected significant activity on February 10, 2014.		2014-February-12 14:08 GMT
53	Cisco Security has detected significant activity on February 10, 2014.		2014-February-11 13:53 GMT
52	Cisco Security has detected significant activity on February 5, 2014.		2014-February-06 13:39 GMT
51	Cisco Security has detected significant activity on February 4, 2014.		2014-February-05 13:05 GMT
50	Cisco Security has detected significant activity on January 28, 2014.		2014-January-29 13:51 GMT
49	Cisco Security has detected significant activity on January 24, 2014.		2014-January-24 20:30 GMT
48	Cisco Security has detected significant activity on January 22, 2014.		2014-January-24 12:41 GMT
47	Cisco Security has detected significant activity on January 21, 2014.		2014-January-22 14:58 GMT
46	Cisco Security has detected significant activity on January 10, 2014.		2014-January-13 14:07 GMT
45	Cisco Security has detected significant activity on January 9, 2014.		2014-January-10 14:55 GMT
44	Cisco Security has detected significant activity on January 8, 2014.		2014-January-09 16:19 GMT
43	Cisco Security has detected significant activity on January 6, 2014.		2014-January-07 13:32 GMT
42	Cisco Security has detected significant activity on January 2, 2014.		2014-January-03 16:53 GMT
41	Cisco Security has detected significant activity on December 24, 2013.		2013-December-24 17:40 GMT
40	Cisco Security has detected significant activity on December 22, 2013.		2013-December-23 13:36 GMT
39	Cisco Security has detected significant activity on December 17, 2013.		2013-December-19 13:48 GMT
38	Cisco Security has detected significant activity on December 16, 2013.		2013-December-18 13:45 GMT
37	Cisco Security has detected significant activity on December 16, 2013.		2013-December-17 14:57 GMT
36	Cisco Security has detected significant activity on December 10, 2013.		2013-December-11 18:24 GMT
35	Cisco Security has detected significant activity on December 8, 2013.		2013-December-09 16:52 GMT
34	Cisco Security has detected significant activity on December 4, 2013.		2013-December-06 16:47 GMT
33	Cisco Security has detected significant activity on December 4, 2013.		2013-December-05 15:49 GMT
32	Cisco Security has detected significant activity on December 1, 2013.		2013-December-03 15:20 GMT
31	Cisco Security has detected significant activity on November 27, 2013.

| | 2013-December-02 16:41 GMT
30 | Cisco Security has detected significant activity on November 25, 2013.

| | 2013-November-27 15:09 GMT
29 | Cisco Security has detected significant activity on November 25, 2013.

| | 2013-November-25 21:29 GMT
28 | Cisco Security has detected significant activity on November 21, 2013.

| | 2013-November-25 15:15 GMT
27 | Cisco Security has detected significant activity on November 21, 2013.

| | 2013-November-22 18:33 GMT
26 | Cisco Security has detected significant activity on November 20, 2013.

| | 2013-November-21 17:27 GMT
25 | Cisco Security has detected significant activity on November 19, 2013.

| | 2013-November-19 20:37 GMT
24 | Cisco Security has detected significant activity on November 18, 2013.

| | 2013-November-18 22:31 GMT
23 | Cisco Security has detected significant activity on November 16, 2013.

| | 2013-November-18 16:44 GMT
22 | Cisco Security has detected significant activity on November 14, 2013.

| | 2013-November-15 16:02 GMT
21 | Cisco Security has detected significant activity on November 13, 2013.

| | 2013-November-14 17:30 GMT
20 | Cisco Security has detected significant activity on November 11, 2013.

| | 2013-November-13 15:33 GMT
19 | Cisco Security has detected significant activity on November 11, 2013.

| | 2013-November-12 19:05 GMT
18 | Cisco Security has detected significant activity on November 7, 2013.

| | 2013-November-07 16:58 GMT
17 | Cisco Security has detected significant activity on November 5, 2013.

| | 2013-November-06 16:11 GMT
16 | Cisco Security has detected significant activity on November 5, 2013.

| | 2013-November-05 19:13 GMT
15 | Cisco Security has detected significant activity on November 2, 2013.

| | 2013-November-04 22:44 GMT
14 | Cisco Security has detected significant activity on October 31, 2013.

| | 2013-October-31 20:03 GMT
13 | Cisco Security has detected significant activity on October 30, 2013.

| | 2013-October-30 17:49 GMT
12 | Cisco Security has detected significant activity on October 29, 2013.

| | 2013-October-30 15:43 GMT
11 | Cisco Security has detected significant activity on October 25, 2013.

| | 2013-October-29 14:55 GMT
10 | Cisco Security has detected significant activity on October 25, 2013.

| | 2013-October-28 15:11 GMT
9 | Cisco Security has detected significant activity on October 25, 2013.

| | 2013-October-25 17:33 GMT
8 | Cisco Security has detected significant activity on October 23, 2013.

| | 2013-October-24 16:35 GMT
7 | Cisco Security has detected significant activity on October 23, 2013.

| | 2013-October-23 16:11 GMT
6 | Cisco Security has detected significant activity on October 21, 2013.

| | 2013-October-22 15:06 GMT
5 | Cisco Security has detected significant activity on October 21, 2013.

| | 2013-October-21 15:21 GMT
4 | Cisco Security has detected significant activity on October 18, 2013.

| | 2013-October-18 14:09 GMT
3 | Cisco Security has detected significant activity on October 17, 2013.

| | 2013-October-17 15:42 GMT
2 | Cisco Security has detected significant activity on October 16, 2013.

| | 2013-October-16 17:29 GMT
1 | Cisco Security has detected significant activity on October 15, 2013. | | 2013-October-15 19:34 GMT
Show Less

---

Legal Disclaimer

• THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products