Today we've seen more than 11,000 copies of their newest attempt come in to the UAB Spam Data Mine. The email received looks like this:
The email contains several falsified header indicators, including at the most basic level that it claims to come from "@nyc.gov". In addition to this, however, there has been a "Received:" tag added to make it appear to have originated from a legitimate New York City IP address:
Received: from nyc.gov ([188.8.131.52]) by xx.xx.xx.xx; Wed, 03 Aug 2011 12:20:46 +0530
The City of New York is the registrant for every IP address beginning with "167.153.*.*" - in fact 184.108.40.206 is the IP address of the website "nyc.gov" where Mayor Bloomberg's homepage can be found.
The other false information is the date. Both the date in the Received: tag and the date in the "Date:" tag have been falsified to make it seem this email has been in your in box for several days by the time you see it.
Just from the falsified header, we would predict that this email is going to be in the same family of malware as the "IRS Notification" and "UPS Notification" emails seen earlier this week, which also contained falsified Received: tags.
The zip file contains an executable file disguised as a PDF file:
When the malware is launched, it connects to "sfkdhjnsfjg.ru" on 220.127.116.11.
from there it fetches "/ftp/g.php" and "pusk3.exe" -- exactly the same as the IRS Notification spam and the UPS Notification spam.
Another group of spam messages this morning pretends to be a notice that you have received money via Western Union.
The attachment is of course a virus:
Money Transfer Information
MONEY TRANSFER INFORMATION
Money Transfer Information 00375
Money Transfer Notice
MONEY TRANSFER NOTICE
MONEY TRANSFER NOTICE 06457
Western Union: Money Transfer For You
WESTERN UNION: MONEY TRANSFER FOR YOU
Western Union: Remittance Advice
WESTERN UNION: REMITTANCE ADVICE
Western Union: Transfer Of Money
WESTERN UNION: TRANSFER OF MONEY
Western Union: You Have Money Transfer
WESTERN UNION: YOU HAVE MONEY TRANSFER
Western Union: You have received a money transfer
WESTERN UNION: YOU HAVE RECEIVED A MONEY TRANSFER
Another top spammed malware attachment today delivers emails with these subjects:
Re: End of July Statement Required
Re: FW: End of July Stat.
Re: FW: End of July Statement
Re: FW: End of July Statement required
Re: FW: End of July Statement Required
Re: FW: End of July Statement REquired
Re: FW: End of July Statement REquired!
Re: FW: End of July Stat. required
Re: FW: End of July Stat. Required
The email body says simply:
As requested i give you open Invoices issued to you as per 5th Aug. 2011
Here's the VirusTotal report for this one.