2014 September 30 12:53 GMT
2016 September 27 13:50 GMT
Email messages that are related to this threat (RuleID8337 and RuleID8337KVR) may contain the following files:
Name | Size in Bytes | MD5 Checksum
Document.zip / Document.scr
payment slip.zip / payment slip.exe
Nicht.zip / Forderung 26.09.2014 - Rechnungsstelle Facebook GmbH.com
| 376,832 | 0xC044345DBFA2FAF6220ACB324C8F3724
Comprovante_Deposito_ DOC.zip / Comprovante_Deposito_ DOC.exe
ET-86831013.zip / TicketDA.exe | 102,400
BANK COPY 54456.zip / chiefo11.exe
Payment_Slip.zip / Payment_Slip.scr
order.zip / order.scr
PRODUCT SAMPLE.PDF.JPG.zip / PRODUCT SAMPLE.scr
Doc .0143 Sample.zip / Doc .0143 Sample.exe
PAYMENT SLIP.zip / payments-details (5).exe
PO-0017384-Order-pdf.zip / PO-0017384-Order-pdf.exe | 572,928 | 0xE7C837125F34E8AEC9583999F085FCD4
product sample.zip / product sample.exe
| 241,664 | 0x81C35FED2AE5FC9C4F46FA3636C9876C
Forderung stornierten Buchung Ihrer Bestellung Ebay vom 29.09.2014.zip /
Forderung 29.09.2014 - Stellvertretender Rechtsanwalt Ebay GmbH.com
| 90,112 | 0x86BEC88B8BACEAC36777D99B7CE8FC2F
Remttnce TT copy.zip / Remittance invoice.xl.scr
| 1,182,276 | 0x1C18FA8605688225D3D43CF53FE5674F
New-Order.xls.zip / New-Order.xls.exe | 378,781
Invoices.exe | 995,328 | 0xBD8BCC6F0125179B357FEF6924E5DC0A
Order#04356.zip / Order#04356.exe | 1,128,960
NFe35160704429377000626550180000994151005007354-xml.jar | 132,061
purchase order - no. BN00089312 TLP545J.zip /
purchase order - no. BN00089312 TLP545J.exe | 200,704
Swift_copy.zip / Swift_copy.exe | 856,064
Payment_Copy.zip / Payment_Copy.vbs | Not Availabl | 0xD706EA5A10662207A139B47100DC0BCC
order #PO-16-000750.zip / order #PO-16-000750.exe | 774,144
slip.zip / slip.jar | Not Available
Order#331-16.jar | Not Available
ORDER.zip / ORDER.exe | 1,249,280
Order.zip / Order.exe | 152,576 | 0x06770DBC85A342A451F1A811F27E993D
Paymentslip.jar | Not Available | 0xFD45F35BC2632F08E1C6353ACD6A36EC
JX-100LED.zip / Balance Payment.exe | 397,312 | 0xB516D098EFBB565F7E518D2B7D20AF7D
BOA Wire Transfer Slip.zip / BOA Wire Transfer Slip.exe | Not Available | 0xAD7B8B62E50B1B08887820AF03664E48
Payment Advice.zip / Payment Advice.exe | 1,420,288
purchase order.ace / purchase order.exe | Not Available | 0xF1B6D0FE8B2A3DA49A7D0EE980EF2F2B
ORDER#325434.jar | Not Available | 0xBC90618576A37893994F984374EAA41A
revised order.jar | 236,259 | 0xA599D3B27208181EE15117BDDA5A1D06
Swift Copy.jar | 236,681 | 0xF3BD0B5D369C364FCC8024836155A912
Order Confirmation.zip / Order Confirmation.exe | 1,114,112 | 0x53C5E20C69A275638BD8CD4C8289C8A7
TT Copy.zip / TT Copy.pif | 761,856
PAYMENT.zip / PAYMENT#details.exe | 458,752
PAYMENT-SLIP.zip / PAYMENT-SLIP.exe | 778,240
Payment Invoice.zip / bot_output7648950.exe | 270,336
NEW ORDER_1A31950.zip / NEW ORDER_1A31950.exe | 188,416
PURCHASE ORDER.zip / PURCHASE ORDER.jar | Not Available | 0xD39F63312EE09400E679C5B58F87060F
payment.zip / payment.exe
Sample.Order.zip / Sample.Order.exe | 481,792 | 0xC144608A02D23093A1631D2BA4513C9D
The following text is a sample of the email message that is associated with this threat outbreak:
> Subject: Payment Confirmation Slip
HSBC - The world's local bank (www.hsbc.com)
About SecureMail Help
Email from HSBC
You have received a message from HSBC secured
Dear Sir/ Madam,
Please kindly download and view payment transfer confirmation attached below.
The payment was made to your account through one of your customers.
> Subject: FW: Order/TT
Good day sir,
How are you today?
pls check attached, my manager had requested I email you our new order
details together with TT copy of balance payment. Kindly confirm in return.
MVP Trading Company, Inc.
> Subject: Message copied from system quarantine
I have forwarded our orders several times without getting any response from you yet.
We will like to know what is causing the delay in response .
Please refer to the attached photo in my email.
I was informed that this was purchased from your company.
I would also like to order this product.
> Subject: Re: Product
Pls check out the sample and get back to us.
Overseas trade administrator
> Subject: payment slip
Kindly be inform that the payment has been made,attach to this mail is
the payment confirmation order.
Do get back to me as soon as you confirm it in your account.
Fine the attachment
> Subject: Urgent
Just wanted to make sure you received the message i tried to deliver to you earlier, Please
view the document i uploaded for you in attachment,
Try to view the document its very important..:.
> Subject: payment slip
Please quote your best price for the attached products, delivery time and availability of the product.
Attached is a Sample Quotation, kindly ensure price is competitive as we await your quote.
> Subject: Payment Details [Incident: 147433-760939]
We could not process your Full Payment Submission.
The submission for reference /UT4015918 was successfully received and was not processed.
Check attached copy (PDF Document) for more information.
> Subject: Re: Sales Inquiry - New Order
I am from Al Abid, Project manager Hitech Electric,
We wish to place an order for the following Items as listed in the above attached document.
It is intended to be delivered within 34 days from the Order confirmation date since
we will be needing it to complete our outsanding projects.
Your urgent attention will be appreciated as we expect your quote which will include:
2. Terms of Payment (preferable T/T)
3. Certifiying Body
4. Expected date of Delivery
Thanks for your co-operations.
Project manager II
> Subject: Product sample
We have confirmed your product but the price is very high.
Please review our attached enquiry and revert with possibility of quote.
Hope you can reply urgently so we can place the order and get it delivered on time.
> Subject: Offene Rechnung 56506548 Ronja Gr?nwoldt
Diese Nachricht wurde von meinem Android Mobiltelefon mit GMX Mail gesendet.
Stellvertretender Rechtsanwalt schrieb:
Sehr geehrte/r Ronja Gr?nwoldt,
Sie haben eine nicht beglichene Forderung bei der Firma Ebay GmbH.
Das von Ihnen gespeicherte Konto wurde im Moment der
Abbuchung nicht genügend gedeckt um die Lastschrift vorzunehmen.
In Vollmacht unseren Mandanten fordern wir Sie auf, die offene
Gesamtforderung schnellstens zu bezahlen. Aufgrund des bestehenden Zahlungsverzug
sind Sie gezwungen zuzüglich, die durch unsere Inanspruchnahme entstandenen
Gebühren von 45,95 Euro zu tragen. Wir erwarten die Zahlung inklusive der Gebühren
bis zum 01.10.2014 auf unser Girokonto. Für Fragen oder Unklarheiten erwarten
wir eine Kontaktaufnahme innerhalb des selben Zeitraums.
Es erfolgt keine weitere Erinnerung oder Mahnung.
Nach Ablauf der festgelegten Frist wird die Akte dem Staatsanwalt und der Schufa übergeben.
Die vollständige Forderungsausstellung, der Sie alle Einzelpositionen entnehmen können, fügen wir bei.
Mit verbindlichen Grüßen
Stellvertretender Rechtsanwalt Günther Christian
> Subject: TT Copy of Remittance
Attached is the remittnce TT copy ref to your PDA
Kindly confirm by return upon receipt.
> Subject: d251f56f5882b7703b9518933f87cc26
How was your weekend?.
Please advice status of shipment of containers for our client
and also confirm if you have sent us the Original Documents (Invoice, Packing List, Bill of Lading, Form E, etc) ?
Have you sent it ? Give us the tracking number.
We have also contacted your colleague about the confirmation but we have not received any response.
Please find attached our balance payment swift copy. Our Boss has discussed with your Company about
the discounts with our previous order.
Kindly check the attached swift copy and confirm if you recieved payment.
Waiting for your urgent response.
> Message Body:
We are interested in your products and services. I am attaching our
purchase order.Please provide me with profoma invoice along with your bank
Download and open attachment immediately for all information regarding our
We keep our word.
> Subject: New Purchase Order
Please view our purchase order. Kindly quote
us best price and send us a confirmation.
I would appreciate a quick reply.
Subject: Segue em anexo a Nota Fiscal eletrônica nº 19713 no formato XML. - 16:42:52
Segue em anexo a Nota Fiscal eletrônica nº 19713 no formato XML.
Chave de acesso: 35160709210718040187550000000197131000219541.
Protocolo nº 135160446701641, emitida em 25/07/2016 940929591655731
> Subject: purchase order - no. BN00089312 TLP545J
We did not receive your response about our last order.
Please confirm enclosed order and inform us the earliest delivery date.
Your prompt reply is needed.
Kindly view the attachment sample and P.O for delivery purpose.
Subject: FYI. SWIFT Text :- US$ 30, 565.00.
SWIFT Text :- US$ 30,565.00. - Message copy
Instance Type and Transmission -------------- ----------------------
Notification (Transmission) of Original sent to SWIFT (ACK)
Network Delivery Status : Network Ack
Subject: Payment copy
Good day to you,
Thank you for your reply email attach is copy of the payment confirmation slip
and our delivery order,
kindly inform us as soon as you have the money
in your account and send us the transport details.
> Subject: order #PO-16-000750 w/ acknowledgment and confirmation
Please see attached for my PO and kindly acknowledge.
Subject: Confirm payment ASAP
We sent you an email few days ago regarding an inquiry that we made few days back
but i did not receive any response from you regarding my order,
so i have just sent it again just in-case you did not receive it....
Please note my new purchase order list in my attached file for your
confirmation, and kindly send me your draft Quotation on the items....
Awaiting your reply.
> Subject: Inquiry
We are in need of your products attached which we saw online. We will like
to know more on the product so we can place our orders. and let us know
the price listing and your payment terms and delivery terms.
Waiting for your response
> Subject: SHIPMENT DOCUMENTS****
See the attached documents for your information.
> Subject: Payment - G.M. Enterprises (JX-100LED x 2 and KE 750 KE760
Dear, Please see attached the remits for
the payment which is scheduled to go out today 8th Augt 2016.
Thanks & Best regards
> > Subject: BOA PAYMENT WIRE SLIP
Please find in enclose attachment (Bank of America) wire transfer
swift copy for your reference as requested by our client/customer.
Transfer will take 1 ro 2 working days to reflect in your bank account
if you have any comment/questions pls refer to your customer for more details.
> Subject: Payment Advice
Please find attached swift copy of invoice and confirm with your bank asap.
> > Subject: PURCHASE ORDER
kindly see the purchase order attached for the items requested and give us your confirmation
on date of shipping.We would also like to inquire about the following:
Delivery time of the product
Minimum Order Quantity
Payment terms available.
See to this request and do the needful.
> Subject: PURCHASE ORDER#325434
Enclosed below is our order specification for August with Quantity,
Kindly advise us with your best quote.
If you have any further queries , please do not hesitate to contact us.
Your prompt response will be appreciated.
> Subject: Revised order
Enclosed please find our requirement attached for your reference.
Please check and confirm by sending your PI.please confirm all
details of our requirement and also provide the delivery date.
If you have further questions please don’t hesitate to contact
Thanks and Best Regard!
> Subject: Payment
Please check the attached swift copy for your references,
Awaits your confirmation Asap.
Thanks and best Regards
> Subject: Confirm Quotation**
Please refer to attach attachment of our profile for
required order.Awaiting for your positive response****
> Subject: SWIFT
Our purchasing dept forwarded your commercial invoice for payment today.
Please find the attached TT payment advice for the last shipment.
Kindly confirm and telex release, the shipping documents
Should you have any queries, please feel free to contact the purchasing dept.
> Subject: Correct Bank Information For Order no. 0093707
Could you please tell me which account no.
is correct below in the attachment for your new banking information:
> Subject: PAYMENT SLIP ATTACHED
Kindly confirm the attached receipt of payment.
> > Subject: PI
We have made the payment of USD 103,349,35. TT copy attached for full payment details.
Document N. AMOUNT DIV.
INVOICE 5328 103,548.25 USD
CREDIT NOTE ECS/CN/06 -198,9 USD
TOTAL AMOUNT 103,349.35 USD
I am forwarding you the e-mail that the brokering company has sent us.
You will receive the money into your account in a couple of days.
Please Complete TT details attached.
> > ****
> Subject: New PO # E1A31950
Attach is our New quotation. kindly quote
your best price for New PO # E1A31950.
Your early reply will be highly appreciated ,
Please Confirm The ASAP.
> Subject: buying inquiry/order
Greetings to you and your company,, This is Steve from Saudi
Railway Company (SAR) from purchase department,we we are
looking for a good company or an agent from korea, That
will hep us supply the above product listed in the Po that
is attached. Kindly review and sign back with your best price
the destination port and address is in the attached Po as
stated in the attached before you stamp it Please reply to this
message with any updates or additional information as necessary
> Subject: order catalog
This is the manager of Arabian BEmco Contracting
Co. Ltd,Please kindly view our attached order
catalog and let me know if you can supply us the same product.
Give me your minimum order
-Your Best Prices and FOB,Port of loading.
-Your estimated delivery time.
-Your Mode of Payment. ( If by L/C or T/T )
Cisco security appliances can help protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Cisco Web Security Appliances help secure and control web and email traffic by offering layers of malware protection. Cisco security appliances are automatically updated to help prevent both spam email and hostile web URLs from being passed to the end user.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products