Antivirus: April 2008 Archives
The SANS ISC Diary has a good write up of the Subpoena in a Civil Case malicious email. Wish I had seen that before investigating the copy our CEO received.
The message is from subpoena@uscourts.com with a display From of United States District Court. It says
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District Court at the place, date, and time specified below.
It has a link to download a document on the matter. The website prompts to install a malicious activeX control.
The malware we received doesn't seem to be the same file the ISC is reporting.
This morning MessageLabs blocked a suspicious message to a recipient in our finance department.
Subject: Re:tax contract for
The message contained a Word document attachment named incomplete_contract.doc. The word doc contained a embedded exe named MicrosoftWordhasencounteredanerrorandneedstoclose.Pleasedoubleclicktheicontoreloadmsword.exe
These are probably the same people who tried last week with subject lines "Re : Tax Refund for %firstname% %lastname% with a scr attachment.
Going through my email I see a similar detection back in February Complaint Filled against
