Threat Outbreak Alert RuleID13021: Email Messages Distributing Malicious Software on May 6, 2015

2015-01-07T14:31:06
ID CISCO-THREAT-36919
Type ciscothreats
Reporter Cisco
Modified 2015-05-07T12:19:00

Description

Medium

Alert ID:

36919

First Published:

2015 January 7 14:31 GMT

Last Updated:

2015 May 7 12:19 GMT

Version:

6

Summary

  • Cisco Security has detected significant activity related to spam email messages distributing malicious software.

Email messages that are related to this threat (RuleID13021 and RuleID13021KVR) may contain the following files:

Name | Size in Bytes | MD5 Checksum
---|---|---
Vera Macedo.CurriculumVitae.zip / Vera Macedo.CurriculumVitae.exe
| 114,688
| 0x4857D5B847118237DD7B7EA1573A1E08
Curriculum Vitae.zip / Curriculum Vitae.exe | 867,840 | 0xE36E2C8341EE3DD3C2F5184D5F79FF1D
CurriculumVitae.zip / CurriculumVitae..exe | 1,702,912 | 0x8FBCF5C547E685499C6C1D71A8B56D6C

Curriculum.Vitae.zip / Curriculum.Vitae.exe
| 2,509,824
| 0x0E7F257975C4F8EFA9A715364CEB75A8

CURRICULUMVITAE.zip / CURRICULUMVITAE.exe | 1,904,640
| 0x1FEB6BF44730B0C51ACC0DEC715CD656

Curriculum_Vitae.zip / Curriculum_Vitae.exe | 2,359,296 | 0x2DD8D613AA3280E5D6F926D40735A535

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: 8203572

Message Body:

Prezado Srs,
Conforme combinado em reunião com a diretoria dessa Empresa - TEIA ( TECNOLOGIA INDUSTRIAL DE RASTREAMENTO ),
venho informar que me coloco a disposição da mesma e envio meu curriculum para análise.
Aguardo contato. ( Dados de contato junto ao curriculum ).
Atenciosamente.

Or

> Subject: Curriculum da Mirian N - 7514400

Message Body:

É uma honra poder entrar em contato com você, como me foi repassado, estou entrando em contato pois, tenho o maior interesse em voltar ao mercado de trabalho, e encontra-se em anexo o meu currículo. Espero que possa apreciar e me indicar para algum cargo. Obrigada.
Atenciosamente

Or

> Subject: CurriculumVitae. - 9930269

Message Body:

Prezado Srs,
Conforme combinado em reunião com a diretoria dessa Empresa - ITE ( IOBRAS TECNOLOGIA E EMPREENDEDORISMO ),
venho informar que me coloco a disposição da mesma e envio meu curriculum para análise.
Aguardo contato. ( Dados de contato junto ao curriculum ).
Atenciosamente.
Laura Barreto Torres.

> Cisco security appliances can help protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Cisco Web Security Appliances help secure and control web and email traffic by offering layers of malware protection. Cisco security appliances are automatically updated to help prevent both spam email and hostile web URLs from being passed to the end user.

Related Links
Cisco Security
Cisco SenderBase Security Network

Revision History

  • Version | Description | Section | Date
    ---|---|---|---
    6 | Cisco Security has detected significant activity on May 6, 2015. | | 2015-May-07 12:19 GMT
    5 | Cisco Security has detected significant activity on May 4, 2015. | | 2015-May-05 11:57 GMT
    4 | Cisco Security has detected significant activity on April 29, 2015. | | 2015-April-29 12:37 GMT
    3 | Cisco Security has detected significant activity on April 16, 2015. | | 2015-April-17 16:18 GMT
    2 | Cisco Security has detected significant activity on March 15, 2015. | | 2015-March-16 13:09 GMT
    1 | Cisco Security has detected significant activity on January 6, 2015. | | 2015-January-07 14:31 GMT
    Show Less

Legal Disclaimer

  • THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products