+ Reply to Thread
Results 1 to 1 of 1

Thread: MALWARE - cryptic link in spam email

  1. #1
    Join Date
    Feb 2008
    Location
    The Celtic Lands
    Posts
    3,776

    MALWARE - cryptic link in spam email

    CAUTION

    The link in this email is associated with a possible MALWARE download


    X-SID-PRA: az <moneymorning@moneymorning.com.au>

    Received: from h1780725.stratoserver.net ([81.169.128.105]) by COL0-MC2-F46.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
    Thu, 9 Feb 2012 01:35:10 -0800

    Origin IP address = 81.169.128.105 = STRATO AG, Pascalstr. 10, D-10587 Berlin, German

    Date: Thu, 9 Feb 2012 10:35:10 +0200
    Message-ID: <C8.A7.42985.IKNP3FUM@moneymorning.com.au>

    Subject: The intrigue about you
    To: ************@********.***
    X-Binding: Australia
    X-rpcampaign: agora450.649290431784
    From: "az" <moneymorning@moneymorning.com.au>
    Return-Path: az@paulsharpe.screaming.net


    The source HTML is copied here, to show the details of the message, which is otherwise cryptic.

    <html>
    <body>
    <span style="font-size: 2pt">And the soft sheep and shaggy goats followed the boyish God.
    <b>
    <pre>
    88
    88 88 88 88 8 88888888 888888 88 88888 88 88 8888888 888888 88888 88 88 8888888 888888 888
    88 88 88 88 888 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88
    88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88
    88 8 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 8 88 88 88 88 88
    88 888 88 8888888 8888888 88 88 88888 88 88 88 88 88 888888 888888 88 88 88 888 88 888888 888888 88
    8888 8888 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 8888 8888 88 88 88 88
    888 888 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 88 888 888 88 88 88 88
    8 8 88 88 88 88 88 88 888888 8888888 88888 888 8888888 88 88888 8 8 8888888 88 88
    88

    The pattern above resolves to "WHAT IS LOVE POWER?"

    ____________________________________________88
    88_______88__88___88_____8___88888888___________88 8888__________88_______88888___88___88_8888888____ ___888888____88888___88_______88__8888888__888888_ ______888
    88_______88__88___88____888_____88__________88__88 ______________88______88___88__88___88_88_________ ___88___88__88___88__88_______88__88_______88___88 _____88_88
    88_______88__88___88___88_88____88__________88__88 ______________88______88___88__88___88_88_________ ___88___88__88___88__88_______88__88_______88___88 ____88___88
    88___8___88__88___88__88___88___88__________88__88 ______________88______88___88__88___88_88_________ ___88___88__88___88__88___8___88__88_______88___88 _________88
    88__888__88__8888888__8888888___88__________88___8 8888__________88______88___88__88___88_888888_____ ___888888___88___88__88__888__88__888888___888888_ ________88
    8888___8888__88___88__88___88___88__________88____ ___88_________88______88___88__88___88_88_________ ___88_______88___88__8888___8888__88_______88_88__ _______88
    888_____888__88___88__88___88___88__________88____ ___88_________88______88___88___88_88__88_________ ___88_______88___88__888_____888__88_______88__88_ ______88
    _8_______8___88___88__88___88___88__________88__88 8888__________8888888__88888_____888___8888888____ ___88________88888____8_______8___8888888__88___88
    __________________________________________________ __________________________________________________ __________________________________________________ ______88



    <a href="http fraserblizmt areCool net"> LINK DISABLED - reported to be "DANGEROUS" by URLVoid and to be MALWARE infected by Trend Micro
    gg
    gggggg gg gggggg gg gg gg gg gggggg gggggg ggggg
    gg gg gg gg gg gg gg gg gg gg gg gg gg gg
    gg gg gg gg ggggg gg gg gg gg gg gg
    gg gg gg gg gg gg ggggggg ggggg ggggg ggggg
    gg gg gg gg gg gg gg gg gg gg gg gg
    gg gg gg gg gg gg gg gg gg gg gg gg gg gg
    gggggg gggggg gg gggggg gg gg gg gg ggggggg gg gg gggggg

    And the one above to "CLICK HERE"
    __________________gg________________________
    _gggggg___gg___________gggggg___gg___gg_________gg ___gg__gggggg___gggggg____gggggg__________________
    gg____gg__gg______gg__gg____gg__gg__gg__________gg ___gg__gg_______gg___gg___gg___________________
    gg________gg______gg__gg________ggggg___________gg ___gg__gg_______gg___gg___gg___________
    gg________gg______gg__gg________gg__gg__________gg ggggg__ggggg____ggggg_____ggggg_________________
    gg________gg______gg__gg________gg___gg_________gg ___gg__gg_______gg__gg____gg_______________
    gg____gg__gg______gg__gg____gg__gg____gg________gg ___gg__gg_______gg___gg___gg______________________ _
    _gggggg___gggggg__gg___gggggg___gg____gg________gg ___gg__ggggggg__gg____gg__gggggg____


    </pre>
    </a>
    Their azure tents between the Attic vines;
    </span>
    </b>
    </body>
    </html>
    Last edited by Garreg Ddu; 02-19-2012 at 12:49 AM.
    Stipendia enim peccati mors sunt.
    "Entia non sunt multiplicanda praeter necessitatem" : Guillelmus de Occam

    Do not annoy the Dragonsfor you are small and crunchy and good with Ketchup.

+ Reply to Thread

Posting Permissions

  • You may post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •