Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Internet Storm Center - SANS Internet Storm Center Internet Storm Center

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

Another Day, Another Spam...

Published: 2016-10-25
Last Updated: 2016-10-25 07:14:00 UTC
by Xavier Mertens (Version: 1)
2 comment(s)

In my last diary[1], I gave an example of an uncommon spam message. But attackers have always new ideas to deliver their malicious content to us. Here are two new examples. October being the Cyber Security Awareness month[2], more examples are always welcome.

The first one was delivered as an "NDR" message ("Non-Delivery Receipt") to the SANS ISC handlers mailbox:

From: "Bounced mail" 
Subject: Mail System Error - Returned Mail
Date: Fri, 21 Oct 2016 22:08:23 +0530
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <>
X-Envelope-To: UNKNOWNX-Loop: handlermail

Your message was not delivered due to the following reason(s):

Your message could not be delivered because the destination server was
not reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura-
tion parameters.

Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.

Your message was not delivered within 1 days:
Server is not responding.

The following recipients could not receive this message:

Please reply to
if you feel this message to be in error.

Attached to this mail, a malicious ZIP file with a .pif file inside. The file is in fact a PE file (MD5: 2aa0d2ae9f8492e2b4acda1270616393). The hash was unknow to VT but once uploaded, it was reported as a very old worm, nothing very malicious.

The second example was received by one of our readers is a fake SharePoint notification:

The link points to hxxp:// (the site has been cleaned up in the meantime). SharePoint is a common Microsoft tool used in big organizations and people could be lured by this kind of message.

Most spam campaigns are easy to detect but some messages, when properly redacted, may lure the victim easily. We are never far from an unfortunate click. Stay safe!


Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant

2 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

A few Mirai Updates: MIPS, PPC version; a bit less scanning
1 day ago by Johannes (0 comments)

ISC Briefing: Large DDoS Attack Against Dyn
2 days ago by Johannes (7 comments)

Request for Packets TCP 4786 - CVE-2016-6385
3 days ago by Guy (0 comments) DDoS Attack
4 days ago by Johannes (9 comments)

How Stolen iOS Devices Are Unlocked
4 days ago by Johannes (0 comments)

Malspam delivers NanoCore RAT
5 days ago by Brad (1 comment)

Spam Delivered via .ICS Files
5 days ago by Xme (3 comments)

OpenSSH Protocol Mismatch In Response to SSL Client Hello
1 week ago by Johannes (0 comments)

View All Diaries →

Latest Discussions

Any experience with hyper-v ram forensic?
created 3 days ago by DrGreen (0 replies)

Question about faux news websites
created 1 week ago by Marko (0 replies)

Event Logging Requirements
created 3 weeks ago by Circadian (4 replies)

Configuring 'cvtwin': Windows 10 and Norton 360 Premier
created 4 weeks ago by Anonymous (0 replies)

Best way to reduce spam?
created 1 month ago by RafealHenco (2 replies)

View All Forums →

Latest News

View All News →

Top Diaries DDoS Attack
4 days ago by Johannes (9 comments)

Critical Cisco ASA IKEv1/v2 Vulnerability. Active Scanning Detected
8 months ago by Johannes (25 comments)

How Stolen iOS Devices Are Unlocked
4 days ago by Johannes (0 comments)

New tool:
1 week ago by Jim (4 comments)

Spam Delivered via .ICS Files
5 days ago by Xme (3 comments)