Analysis of malicious SPAM emails received January 2013

1. MALWARE SPAM – JANUARY 2013
Type - Sent from Sent from Contains my
Type - Criminal malformed compromised email
Total # Type - Type - Green Type - Type - Background Type - Malicious Malicious Attachment Attachment Attachment email known address in
Received Viagra Job Card Banking LinkedIn Check Other Link Attachment Type - .ZIP Type - .DOC Type - . PDF header contact "TO" field
8^ 1 1 1 2 0 2 1 7 0 - - - 7 0 5
* Malicious SPAM is defined by me as any unsolicited email that
contains a potential information security risk. This does not include the
usual marketing newsletter emails. Only those for which there is not a
prior affiliation and that make it into my mail box.
^ January 2013 is not a complete month due to the automatic
deletion rules of my account

2. JANUARY 2013 - DETAILS
Sent from Sent from Contains my email
Malicious Link Malicious Attachment malformed compromised address in "TO"
Date Type Link Shortener Link Masking Link Host Link Risks Attachment Type email header known contact Listed Email Host Real Email Host Domain Proxy Service Registration Information Country Hosting Domain (IP) field
fineoffr.com - Unknown (do4u.co.il, a.gtld-
fineoffr.com - Yes servers.net)
USA Green phpconvey.com, fineoffr.com (WhoisGuard) phpconvey.com - Israel (do4u.co.il, digital- fineoffr.com - UK
1 14/01/2013 Card Yes No Yes - Basic phpconvey.com No - Yes No canforward.com (via mail.visimail.org ) phpconvey.com - No campaign.info) phpconvey.com - UK (by eukhost.com) Yes
2 15/01/2013 Job offer No - - - - No - No No hotmail.com hotmail.com N/A Yes
1. Performs File Modification and Destruction. The executable
modifies and destructs files which are not temporary.
2. Changes security settings of Internet Explorer. This system
alteration could seriously affect safety surfing the World
Wide Web.
bartstals.be - Belgium bartstals.be - Netherlands (by instep.be)
Direct 3. Performs Registry Activities. The executable creates and/or gdoehling.de (via gdoehling.de - Germany gdoehling.de - Germany (by strato.de)
3 23/01/2013 Deposit Bank Yes No Yes - Basic rogercbryan.com modifies registry entries. No - Yes No direct.nacha.org bartstals.be) rogercbryan.com - USA rogercbryan.com - USA (by softlayer.com) Yes
Criminal No (ISP
background 180.248.23.146 - Yes tpg.com.au listed
4 23/01/2013 check Yes No Yes - Basic amazonaws.com No - Yes No yahoo.com 180.248.23.146 (no Whois record) - 180.248.23.146 - Indonesia (by telkom.net.id) as recipient)
nadaorganics.com - USA (by GoDaddy.com)
lifeflowki.com - No DNS record
1. Watches MSN Messenger (msmsgs.exe) cswineimports.com - Yes nadaorganics.com - Australia (lifeflowki.com) cswineimports.com - USA (by lunarpages.com)
Direct cswineimports.com (via (Network Solutions Private cswineimports.com - Unknown maxime-tortelier.com - Germany (by
5 24/01/2013 Deposit Bank Yes No Yes - Basic maxime-tortelier.com 2. Watches the Windows login (winlogon.exe) No - Yes No direct.nacha.org nadaorganics.com) Registration) maxime-tortelier.com - France oneandone.net) Yes
Fake No (yahoo.com
emergency 187.151.36.39 - Yes listed as
6 24/01/2013 warning Yes No Yes - Basic amazonaws.com No - Yes No yahoo.com 187.151.36.39 (no Whois record) - 187.151.36.39 - Mexico (by UNINET.NET.MX) recipient)
ties.itu.int (International Telecommunication
Union) - Switzerland
aroni.com.tr - Turkey (by gridtelekom.com /
bn.by - Belarus (ties.itu.int) grid.com.tr)
Viagra / aroni.com.tr - Turkey (veriturk.com) marijuanarxmedicine.com - UK (by
7 26/01/2013 Stamina Yes No No aroni.com.tr 1. Redirects to marijuanarxmedicine.com No - Yes No None mail.bn.by (via mail.bn) marijuanarxmedicine.com - Russia (cheapbox.ru) as29550.net) Yes
Criminal No (ISP
background 41.135.96.182 - Yes (no Whois 41.135.96.182 - South Africa (by mweb.com, tpg.com.au listed
8 27/01/2013 check Yes No Yes - Basic amazonaws.com No - Yes No yahoo.com 41.135.96.182 record) - via mweb.co.za, optinet.net) as recipient)
TOTAL 7/8 0 6/7 0 7/8 0 5/8
January SPAM emails were analysed on 14/02/2013, therefore some links were no longer active
(eg. Amazon Web Services)