MVP Jubo Security Blog

The Blog

Recent Posts

Tags

News

  • Kim's Journal
    My wife's blog, the "alternative" truth...


    MVPs
    2003 - 2004 - 2005 - 2006 - 2007 - 2008 - 2009


    Jubo





    Locations of visitors to this page

Community

Email Notifications

MVP Sites

Microsoft Links

Blogs

Security Forums

Microsoft Blogs

Archives

An Online ticket?!?

What a surprise... This morning I was happily working at the office, hhmm... okay, from home..., when Outlook notified me that I had received an email. When I checked it was from an unknown company USA3000 Airlines. When I read the email they even had a ticket for me and had charged the credit card for $646.27. I thought, that should be at least a ticket to fly across the pond. Well, could have been a surprise from my wife since she's visiting family in the USA. But no, I unzipped the file and there was a file called: "eTicket.doc.exe" and... not detected by McAfee's antivirus program... yet... Submitted the file to VirusTotal and you can find the result here.

Then I also submitted the file to McAfee's WebImmune and they found a "new detection" and named it "spy-agent.bw". Not really a new one but a new variant. Not long after that I received an "Extra.dat" file from AvertLabs for some extra protection. See also McAfee's Avert Labs Blog: Invoice Spam Takes Flight

No e-ticket for me this morning... but the computer is still safe. Now I only wonder how it came through the company's security. They run Symantec stuff...

Comments

Corrine said:

"Now I only wonder how it came through the company's security. They run Symantec stuff..."

Gee, now how did that get through "Symantec stuff"?  lol

# September 24, 2008 1:18 PM

harry said:

Hi Jubo You got one of those leading edge variants (where they constantly change MD5 hashses and signature files and handled it well).

msmvps.com/.../airline-invoices-and-e-tickets-fake-malware-versions-circulating.aspx

# September 24, 2008 4:16 PM