FAKE ROYAL MAIL EMAIL TROJAN VIRUS

[davo172]

http://blog.mxlab.eu/2013/12/02/fak...l-regarding-detained-package-contains-trojan/

Had this today just thought its worth mentioning !

 

[Chip-mk1]

Its scarey that a trojan can get into a PDF really, Im sure a lot of people assume thats a safe attachment type to be opening.

 

[ThomasBrentnall]

Its scarey that a trojan can get into a PDF really, Im sure a lot of people assume thats a safe attachment type to be opening.

It doesn't get into the pdf at all! File extension is filename.pdf.exe with the program icon set to be the same as a pdf document. Easy really!

 

[davo172]

Does look pretty legit at first glance thou tbh can see a few gettin fooled by this !

 

[Chip-mk1]

It doesn't get into the pdf at all! File extension is filename.pdf.exe with the program icon set to be the same as a pdf document. Easy really!

No mention of .exe in that link:

The attached ZIP file has the name Royal-Mail_B0AE39A385.zip and contains the 107 kB large file RoyalMail_Report-ID-37846378962513415238471238476218736487123684.pdf

I was also under the impression that there were exploits that COULD run from a PDF:
http://www.pcmag.com/article2/0,2817,2362351,00.asp


If you are opening any .exe file you dont know the background of and got mailed to you in a zip, you probably need to be going on some sort of internet awareness course, lol.

 

[ThomasBrentnall]

[h=4]https://malwr.com/analysis/OGJkMTJiNGU4OTUxNGFjNTg3OWY2OTc4MTNiMjdhMTI/

File Details[/h]

FILE NAME	RoyalMail_Report-ID-37846378962513415238471238476218736487123684.pdf.exe
FILE SIZE	106496 bytes
FILE TYPE	PE32 executable (GUI) Intel 80386, for MS Windows

 

[Chip-mk1]

https://malwr.com/analysis/OGJkMTJiNGU4OTUxNGFjNTg3OWY2OTc4MTNiMjdhMTI/

File Details

FILE NAME	RoyalMail_Report-ID-37846378962513415238471238476218736487123684.pdf.exe
FILE SIZE	106496 bytes
FILE TYPE	PE32 executable (GUI) Intel 80386, for MS Windows

Misleading original article then, fair enough, nothing at all new about opening a .exe file and it executing then TBH!

 

[ThomasBrentnall]

Misleading original article then, fair enough, nothing at all new about opening a .exe file and it executing then TBH!

Yeah the article is misleading as they don't mention it at all!

 

[Munson]

Additionally, many Windows users won't be displaying file extensions for known file types. It'll just appear to be a pdf to the untrained eye?

 

[ThomasBrentnall]

Additionally, many Windows users won't be displaying file extensions for known file types. It'll just appear to be a pdf to the untrained eye?

No, it will display in Windows explorer as "RoyalMail_Report-ID-37846378962513415238471238476218736487123684.pdf" because the actually extension is ".exe" which will be hidden. A normal PDF would be listed in Windows explorer as "RoyalMail_Report-ID-37846378962513415238471238476218736487123684" as the .pdf would be hidden

 

[Munson]

Yes but would the type of person with extensions disabled notice the .pdf and wonder why it's there? Not likely.

 

[Chip-mk1]

Yes but would the type of person with extensions disabled notice the .pdf and wonder why it's there? Not likely.

Hence it would make a LOT more sense if the "default" wasnt to hide extensions really. Im not convinced it really helps users by cleaning things up as much as it can potentially confuse them at a time like this.

 

[Munson]

Hence it would make a LOT more sense if the "default" wasnt to hide extensions really. Im not convinced it really helps users by cleaning things up as much as it can potentially confuse them at a time like this.

Yes indeed it would. Heavily retarded.

 

[spuzzcake]

If the file extension wasn't hidden then when renaming any file you would have to include the extension for that file in the rename.

This would lead to a lot of people with files that windows wouldn't know what program to use to open them

 

[Addicted]

Not if it wasn't hidden in the first place, because renaming would show you the file extension in the first place

Plus when you have file extensions shown, when you go to rename it only highlights the name to be replaced, not the extension as well!

 

[GiT]

Awaiting the call off the old man getting sucked in. The idiot.

 

[BoatNonce]

Common sense would tell you not to open that.

Sadly common sense isn't common.

 

[ThomasBrentnall]

Common sense would tell you not to open that.

Sadly common sense isn't common.

This is the issue mate, no one uses their brains. Try working with IT in a school

RM tweeted earlier warning people of this

 

[BoatNonce]

Try working with IT in a school

Does hacking into the staff drive count? The christmas bash photos were interesting.

 

[davo172]

Awaiting the call off the old man getting sucked in. The idiot.

FLOL ^^^^