Advertisement
MalwareMustDie

#MalwareMustDie - Evidence of the fake FBI alert mail.

Apr 7th, 2013
1,429
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.39 KB | None | 0 0
  1. // Evidence of the fake FBI alert mail.
  2. // #MalwareMustDie - Analyzed by: @unixfreaxjp
  3. // [0x00000000:0x00400000]> !date
  4. // Sun Apr 7 16:05:51 JST 2013
  5.  
  6. // Evidence first
  7.  
  8.  
  9. Delivered-To: xxx@xxx
  10. Received: by 10.229.13.217 with SMTP id d25csp240276qca;
  11. Fri, 5 Apr 2013 13:29:49 -0700 (PDT)
  12. X-Received: by 10.66.102.98 with SMTP id fn2mr16858333pab.192.1365193789161;
  13. Fri, 05 Apr 2013 13:29:49 -0700 (PDT)
  14. Return-Path: <wlijdjrry@hotmail.com>
  15. Received: from nm22-vm7.bullet.mail.ird.yahoo.com (nm22-vm7.bullet.mail.ird.yahoo.com. [212.82.109.226])
  16. by mx.google.com with SMTP id as5si15551165pbd.266.2013.04.05.13.29.46;
  17. Fri, 05 Apr 2013 13:29:49 -0700 (PDT)
  18. Received-SPF: softfail (google.com: domain of transitioning wlijdjrry@hotmail.com does not designate 212.82.109.226 as permitted sender) client-ip=212.82.109.226;
  19. Authentication-Results: mx.google.com;
  20. spf=softfail (google.com: domain of transitioning wlijdjrry@hotmail.com does not designate 212.82.109.226 as permitted sender) smtp.mail=wlijdjrry@hotmail.com
  21. Received: from [77.238.189.50] by nm22.bullet.mail.ird.yahoo.com with NNFMP; 05 Apr 2013 20:29:44 -0000
  22. Received: from [46.228.39.37] by tm3.bullet.mail.ird.yahoo.com with NNFMP; 05 Apr 2013 20:29:44 -0000
  23. Received: from [127.0.0.1] by smtp170.mail.ir2.yahoo.com with NNFMP; 05 Apr 2013 20:29:44 -0000
  24. X-Yahoo-Newman-Id: 973306.90212.bm@smtp170.mail.ir2.yahoo.com
  25. Message-ID: <973306.90212.bm@smtp170.mail.ir2.yahoo.com>
  26. X-Yahoo-Newman-Property: ymail-3
  27. X-YMail-OSG: 86jPt4UVM1nTwB9Es8LPsbaBOP0w9tT5mURiTgG2.1RbIgk
  28. JvzYRJslK0hOGmx7_pOF_1x_AkJSI4qs49IeO75xAHTuVw6D_1A3I45QPx7u
  29. x4TU9TP5d0t73EZO.XjQsMFQZJ8gAL7.2FOGAl60VVSbbvikntZVsN4oSpF5
  30. uTffB79DQ2CWaj.oigkG9f.Mc26XvchmbcBJWdOKs05LNd5jGSuWKnrZZCcd
  31. w4Jn9ywv.a4Pq3vKyW4YE2VwPFJ_ra8cKS_Wo1HAsA._VjVxd_ccIiJBl2Cu
  32. NzQ3IqaL.cEKLWmw73I0aSuprEtkjvC_pYIM0dCPi2q_jZCjwS_EU0sqibNl
  33. yTRGV95QNBGYUkb_2_gm7fWIYea5WXbnP0Uyrco1UJE91DmcnAwpXpBMgR.w
  34. HFI6Sd6wnCEeLncl7h_TzPZUMSWqgRxAohZEN8do.V6l4umVCfn90tSCqB_j
  35. d5hBwcOxYYpqD5O8hPI3a1NPVHJtoWJXl0OX830e.ZEphvjRdEC6j3r0xRhW
  36. S85oG
  37. X-Yahoo-SMTP: LlMTR5qswBCKF_5JWXrxj2GTVoKjYNOP5LgYsjQqtQ--
  38. X-Rocket-Received: from User (wlijdjrry@217.172.136.214 with login)
  39. by smtp170.mail.ir2.yahoo.com with SMTP; 05 Apr 2013 20:29:44 +0000 UTC
  40. Reply-To: <robertmullerrobertmueller@rocketmail.com>
  41. From: "Mr Robert M"<wlijdjrry@hotmail.com>
  42. Subject: READ URGENTLY
  43. Date: Fri, 5 Apr 2013 21:29:28 +0100
  44. MIME-Version: 1.0
  45. Content-Type: multipart/mixed;
  46. boundary="----=_NextPart_000_0113_01C2A9A6.72FEA680"
  47. X-Priority: 3
  48. X-MSMail-Priority: Normal
  49. X-Mailer: Microsoft Outlook Express 6.00.2600.0000
  50. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
  51.  
  52. This is a multi-part message in MIME format.
  53.  
  54. ------=_NextPart_000_0113_01C2A9A6.72FEA680
  55. Content-Type: text/html;
  56. charset="Windows-1251"
  57. Content-Transfer-Encoding: 7bit
  58.  
  59. <HTML><HEAD><TITLE></TITLE>
  60. </HEAD>
  61. <BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
  62. <FONT size=2 color=#000000 face="Arial">
  63. <DIV>
  64. &nbsp;</DIV>
  65. <DIV>
  66. FEDERAL BUREAU OF INVESTIGATIONS</DIV>
  67. <DIV>
  68. 935 Pennsylvania Avenue Northwest</DIV>
  69. <DIV>
  70. Washington D.C., DC 20535, United States</DIV>
  71. <DIV>
  72. Tel/Fax(202) 324-4008</DIV>
  73. <DIV>
  74. &nbsp;</DIV>
  75. <DIV>
  76. READ THE ATTACHED EMAIL AND COMPLY URGENTLY IT IS VIRUS FREE.</DIV>
  77. <DIV>
  78. &nbsp;</DIV>
  79. <DIV>
  80. MR ROBERT MUELLER</DIV>
  81. <DIV>
  82. DIRECTOR</DIV>
  83. <DIV>
  84. UNITED STATES DEPARTMENT OF JUSTICE</DIV>
  85. <DIV>
  86. FEDERAL BUREAU OF INVESTIGATIONS</DIV>
  87. <DIV>
  88. &nbsp;</DIV>
  89. </FONT>
  90. </BODY></HTML>
  91.  
  92. ------=_NextPart_000_0113_01C2A9A6.72FEA680
  93. Content-Type: application/octet-stream;
  94. name="URGENT INFORMATION FOR YOU.txt"
  95. Content-Transfer-Encoding: base64
  96. Content-Disposition: attachment;
  97. filename="URGENT INFORMATION FOR YOU.txt"
  98.  
  99. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  100. ICAgICAgICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgICAgICAg
  101. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  102. ICAgICANCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  103. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAg
  104. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQpGRURFUkFMIEJV
  105. UkVBVSBPRiBJTlZFU1RJR0FUSU9OUw0KOTM1IFBlbm5zeWx2YW5pYSBBdmVu
  106. dWUgTm9ydGh3ZXN0DQpXYXNoaW5ndG9uIEQuQy4sIERDIDIwNTM1LCBVbml0
  107. ZWQgU3RhdGVzDQpUZWwvRmF4KDIwMikgMzI0LTQwMDgNCiANCiANCkF0dGVu
  108. dGlvbiBCZW5lZmljaWFyeSwNCiANCiAgICAgICAgICAgICAgICAgICAgICAg
  109. ICAgICAgICAgICAgICAgICAgICBVUkdFTlQgSU5GT1JNQVRJT04gRk9SIFlP
  110. VSAsRk9SIDIwMTMNCiANClJlY29yZHMgc2hvdyB0aGF0IHlvdSBhcmUgYW1v
  111. bmcgb25lIG9mIHRoZSBpbmRpdmlkdWFscyBhbmQgb3JnYW5pemF0aW9ucyB3
  112. aG8gYXJlIHlldCB0byByZWNlaXZlIHRoZWlyIG92ZXJkdWUgcGF5bWVudCBm
  113. cm9tIG92ZXJzZWFzIHdoaWNoIGluY2x1ZGVzIHRob3NlIG9mIExvdHRlcnkv
  114. R2FtYmxpbmcsIENvbnRyYWN0IGFuZCBJbmhlcml0YW5jZS4gVGhyb3VnaCBv
  115. dXIgRnJhdWQgTW9uaXRvcnkgVW5pdCB3ZSBoYXZlIGFsc28gbm90aWNlZCB0
  116. aGF0IG92ZXIgdGhlIHBhc3QgeW91IGhhdmUgYmVlbiB0cmFuc2FjdGluZyB3
  117. aXRoIHNvbWUgaW1wb3N0ZXJzIGFuZCBmcmF1ZHN0ZXJzIHdobyBoYXZlIGJl
  118. ZW4gaW1wZXJzb25hdGluZyB0aGUgbGlrZXMgb2YgUHJvZi4gU29sdWRvIG9m
  119. IHRoZSBDZW50cmFsIEJhbmsgT2YgTmlnZXJpYSwgTXIuIFBhdHJpY2sgQXpp
  120. emEsIEFuZGVyc29uLCBXYWxsYWNlIEZyZWQsIG5vbmUgb2ZmaWNpYWxzIG9m
  121. IE9jZWFuaWMgQmFuaywgWmVuaXRoIEJhbmtzLCBLZWx2aW4gWW91bmcgb2Yg
  122. SFNCQyxCYW5rIG9mIEFtZXJpY2EgVG9wIG9mZmljaWFscyxDaXRpIEJhbmss
  123. TWFqb3IgQmFua3MgaW4gU3BhaW4sTG9uZG9uLCBTbWl0aCBXaWxsaWFtcywg
  124. RGFuaWVsIFdpbHNvbiwgSWJyYWhpbSBTdWxlLCBEci4gUGhpbGlwIE1vcmdh
  125. biwgRHIuIFVzbWFuIFNoYW1zdWRkZWVuIGFuZCBzb21lIGltcG9zdGVycyBj
  126. bGFpbWluZyB0byBiZSBUaGUgRmVkZXJhbCBCdXJlYXUgb2YgSW52ZXN0aWdh
  127. dGlvbi4NCiANClRoZSBDeWJlciBDcmltZSBEaXZpc2lvbiBvZiB0aGUgRkJJ
  128. IGdhdGhlcmVkIGluZm9ybWF0aW9uIGZyb20gdGhlIEludGVybmV0IENyaW1l
  129. IENvbXBsYWludCBDZW50ZXIgKElDQ0MpIGZvcm1lcmx5IGtub3duIGFzIHRo
  130. ZSBJbnRlcm5ldCBGcmF1ZCBDb21wbGFpbnQgQ2VudGVyIChJRkNDKSBvZiBo
  131. b3cgc29tZSBwZW9wbGUgaGF2ZSBsb3N0IG91dHJhZ2VvdXMgc3VtcyBvZiBt
  132. b25leSB0byB0aGVzZSBpbXBvc3RlcnMuIEFzIGEgcmVzdWx0IG9mIHRoaXMg
  133. d2UgaGVyZWJ5IGFkdmlzZSB5b3UgdG8gc3RvcCBjb21tdW5pY2F0aW9uIHdp
  134. dGggYW55IG9uZSBub3QgcmVmZXJyZWQgdG8geW91IGJ5IHVzLg0KV2UgaGF2
  135. ZSBuZWdvdGlhdGVkIHdpdGggdGhlIEZlZGVyYWwgTWluaXN0cnkgb2YgRmlu
  136. YW5jZSB0aGF0IHlvdXIgcGF5bWVudCB0b3RhbGluZyAkNi4xbWlsbGlvbiB1
  137. bml0ZWQgc3RhdGVkIGRvbGxhcnMgd2lsbCBiZSByZWxlYXNlZCB0byB5b3Ug
  138. dmlhIGEgY3VzdG9tIHBpbiBiYXNlZCBBVE0gY2FyZCB3aXRoIGEgbWF4aW11
  139. bSB3aXRoZHJhd2FsIGxpbWl0IG9mIFRocmVlIHRob3VzYW5kIHVzIGRvbGxh
  140. cnMgJDMsMDAwIGEgZGF5IHdoaWNoIGlzIHBvd2VyZWQgYnkgVmlzYSBDYXJk
  141. IGFuZCBjYW4gYmUgdXNlZCBhbnl3aGVyZSBpbiB0aGUgd29ybGQgd2VyZSB5
  142. b3Ugc2VlIGEgVmlzYSBDYXJkIExvZ28gb24gdGhlIEF1dG9tYXRpYyBUZWxs
  143. ZXIgTWFjaGluZSAoQVRNKS4gV2UgaGF2ZSBhZHZpc2VkIHRoYXQgdGhpcyBz
  144. aG91bGQgYmUgdGhlIG9ubHkgd2F5IGEgd2hpY2ggeW91IGFyZSB0byByZWNl
  145. aXZlIHlvdXIgcGF5bWVudCBiZWNhdXNlIGl0P3MgbW9yZSBndWFyYW50ZWVk
  146. LCBzaW5jZSBvdmVyIEZpZnRlZW4gYmlsbGlvbiB1cyBkb2xsYXJzIHdhcyBs
  147. b3N0IG9uIGZha2UgY2hlcXVlIGxhc3QgeWVhciAyMDEyLg0KIA0KV2UgZ3Vh
  148. cmFudGVlIDEwMCUgcmVjZWlwdCBvZiB5b3VyIHBheW1lbnQsIGJlY2F1c2Ug
  149. d2UgaGF2ZSBwZXJmZWN0ZWQgZXZlcnl0aGluZyBpbiByZWdhcmRzIHRvIHRo
  150. ZSByZWxlYXNlIG9mIHlvdXIgJDYuMSBtaWxsaW9uIHVuaXRlZCBzdGF0ZWQg
  151. ZG9sbGFycyB0byBiZSAxMDAlIHJpc2sgZnJlZSBhbmQgZnJlZSBmcm9tIGFu
  152. eSBoaXRjaGVzIGFzIGl0cyBvdXIgZHV0eSB0byBwcm90ZWN0IGNpdGl6ZW5z
  153. IG9mIHRoZSBVbml0ZWQgU3RhdGVzIG9mIEFtZXJpY2EuIChUaGlzIGlzIGFz
  154. IGEgcmVzdWx0IG9mIHRoZSBtYW5kYXRlIGZyb20gVVMgR292ZXJubWVudCB0
  155. byBtYWtlIHN1cmUgYWxsIGRlYnRzIG93ZWQgdG8gY2l0aXplbnMgb2YgQW1l
  156. cmljYW4gd2hpY2ggaW5jbHVkZXMgSW5oZXJpdGFuY2UsIENvbnRyYWN0LCBH
  157. YW1ibGluZy9Mb3R0ZXJ5IGV0YyBhcmUgYmVlbiBjbGVhcmVkIGZvciB0aGUg
  158. YmV0dGVybWVudCBvZiB0aGUgY3VycmVudCBlY29ub21pYyBzdGF0dXMgb2Yg
  159. dGhlIG5hdGlvbiBhbmQgaXRzIGNpdGl6ZW5zIGFzIGhlIGhhcyBhbHdheXMg
  160. YmVsaWV2ZWQgT3VyIFRpbWUgZm9yIENoYW5nZSBoYXMgY29tZSBiZWNhdXNl
  161. IENoYW5nZSBjYW4gaGFwcGVuKS4NCiANCkJlbG93IGFyZSBmZXcgbGlzdCBv
  162. ZiB0cmFja2luZyBudW1iZXJzIHlvdSBjYW4gdHJhY2sgZnJvbSBVc3BzIHdl
  163. YnNpdGUgdG8gY29uZmlybSBwZW9wbGUgbGlrZSB5b3Ugd2hvIGhhdmUgcmVj
  164. ZWl2ZWQgdGhlaXIgcGF5bWVudCBzdWNjZXNzZnVsbHkuDQogDQpOYW1lIDog
  165. Q0hBUkxPVFRFIE5FV0VMTDogVXNwcyBUcmFja2luZyBOdW1iZXI6IEVPOTg0
  166. NTQyNjg4VVMNCiANCiANClRvIHJlZGVlbSB5b3VyIGZ1bmQgeW91IGFyZSBo
  167. ZXJlYnkgYWR2aXNlZCB0byBjb250YWN0IHRoZSBBVE0gQ2FyZCBDZW50ZXIg
  168. dmlhIGVtYWlsIGZvciB0aGVpciByZXF1aXJlbWVudCB0byBwcm9jZWVkIGFu
  169. ZCBwcm9jdXJlIHlvdXIgQXBwcm92YWwgb2YgUGF5bWVudCBXYXJyYW50IGFu
  170. ZCBFbmRvcnNlbWVudCBvZiB5b3VyIEFUTSBSZWxlYXNlIE9yZGVyIG9uIHlv
  171. dXIgYmVoYWxmIHdoaWNoIHdpbGwgY29zdCB5b3UgJDEwNSBvbmx5IG5vdGhp
  172. bmcgbW9yZSBhbmQgbm8gaGlkZGVuIGZlZXMgYXMgZXZlcnl0aGluZyBlbHNl
  173. IGhhcyBiZWVuIHRha2VuIGNhcmVkIG9mIGJ5IHRoZSBGZWRlcmFsIEdvdmVy
  174. bm1lbnQgaW5jbHVkaW5nIHRheGVzLCBjdXN0b20gcGFwZXIgYW5kIGNsZWFy
  175. YW5jZSBkdXR5IHNvIGFsbCB5b3Ugd2lsbCBldmVyIG5lZWQgdG8gcGF5IGlz
  176. ICQxMDUgb25seS4NCkNvbnRhY3QgSW5mb3JtYXRpb24NCg0KTmFtZTogTXIg
  177. Tm91bGFuZCBTYW1zb24NCkVtYWlsOiBkcm5vdWxhbmRzYW1zb25Acm9ja2V0
  178. bWFpbC5jb20NClRlbDogKzEtMzAzLTczMS0yODIzDQpEbyBjb250YWN0IE5v
  179. dWxhbmQgU2Ftc29uIG9mIHRoZSBBVE0gQ2FyZCBDZW50ZXIgdmlhIGhpcyBj
  180. b250YWN0IGRldGFpbHMgYWJvdmUgYW5kIGZ1cm5pc2ggaGltIHdpdGggeW91
  181. ciBkZXRhaWxzIGFzIGxpc3RlZCBiZWxvdzoNCllvdXIgZnVsbCBOYW1lOg0K
  182. WW91ciBBZGRyZXNzOg0KSG9tZS9DZWxsIFBob25lOg0KT2NjdXBhdGlvbjoN
  183. CkFnZToNCiANCk9uIGNvbnRhY3RpbmcgaGltIHdpdGggeW91ciBkZXRhaWxz
  184. IHlvdXIgZmlsZXMgd291bGQgYmUgdXBkYXRlZCBhbmQgaGUgd2lsbCBiZSBz
  185. ZW5kaW5nIHlvdSB0aGUgcGF5bWVudCBpbmZvcm1hdGlvbiBpbiB3aGljaCB5
  186. b3Ugd2lsbCB1c2UgaW4gbWFraW5nIHBheW1lbnQgb2YgJDEwNSB0byBoaW0g
  187. Zm9yIHRoZSBwcm9jdXJlbWVudCBvZiB5b3VyIEFwcHJvdmFsIG9mIFBheW1l
  188. bnQgV2FycmFudCBhbmQgRW5kb3JzZW1lbnQgb2YgeW91ciBBVE0gUmVsZWFz
  189. ZSBPcmRlci4gQWZ0ZXIgd2hpY2ggdGhlIGRlbGl2ZXJ5IG9mIHlvdXIgQVRN
  190. IGNhcmQgd2lsbCBiZSBlZmZlY3RlZCB0byB5b3VyIGRlc2lnbmF0ZWQgaG9t
  191. ZSBhZGRyZXNzIHdpdGhvdXQgYW55IGZ1cnRoZXIgZGVsYXksIGV4dHJhIGZl
  192. ZSBvciBhbnkgYXV0aG9yaXR5IHJhaXNpbmcgZXllYnJvdy4NCiANCiANClVw
  193. b24gcmVjZWlwdCBvZiBwYXltZW50IHRoZSBkZWxpdmVyeSBvZmZpY2VyIHdp
  194. bGwgZW5zdXJlIHRoYXQgeW91ciBwYWNrYWdlIGlzIHNlbnQgd2l0aGluIDI0
  195. IHdvcmtpbmcgaG91cnMuIEJlY2F1c2Ugd2UgYXJlIHNvIHN1cmUgb2YgZXZl
  196. cnl0aGluZyB3ZSBhcmUgZ2l2aW5nIHlvdSBhIDEwMCUgbW9uZXkgYmFjayBn
  197. dWFyYW50ZWUgaWYgeW91IGRvIG5vdCByZWNlaXZlIHlvdXIgQVRNIENBUkQg
  198. U2hpcHBtZW50IENvbmZpcm1hdGlvbiB3aXRoaW4gdGhlIG5leHQgMjRocnMg
  199. YWZ0ZXIgeW91IGhhdmUgbWFkZSB0aGUgcGF5bWVudCBmb3Igc2hpcHBpbmcu
  200. DQogDQpPbmNlIGFnYWluIHdlIGFyZSBzbyBzdXJlIG9mIHlvdSByZWNlaXZp
  201. bmcgeW91ciBwYXltZW50IGF0IG5vIGFueSBvdGhlciBjb3N0IGFzIHdlIGhh
  202. dmUgdGFraW5nIGl0IHVwb24gb3VyIGR1dHkgdG8gbW9uaXRvciBldmVyeXRo
  203. aW5nIGluIG90aGVyIHRvIGN1YiBjeWJlciBjcmltZSB0aGF0IGlzIHBlcnBl
  204. dHJhdGVkIGJ5IHRob3NlIGltcG9zdG9ycy5Zb3UgYXJlIHJlcXVlc3RlZCB0
  205. byBjdXQgZnVydGhlciBjb21tdW5pY2F0aW9ucyB3aXRoIHRoZXNlIGltcG9z
  206. dG9ycy9mcmF1ZHN0ZXJzIGFzIGNoYXJnZXMgb2YgY29uc2lwcmFjeSB3aWxs
  207. IGJlIGxldmVsbGVkIGFnYWluc3QgYXMgYW4gYWNjb21wYW5pZXMgaWYgeW91
  208. IGNvbnRpbnVlLiBmb3J3YXJkIGV2ZXJ5IGNvcnJlc3BvbmRpbmcgZW1haWwg
  209. cmVjZWl2ZWQgZnJvbSB0aGVtIHRvIHNwYW1tZXNzYWdlc21vbml0b3JpbmdA
  210. Z21haWwuY29tDQogDQpUaGFua3MgYW5kIGhvcGUgdG8gcmVhZCBmcm9tIHlv
  211. dSBzb29uLg0KIA0KTVIgUk9CRVJUIE1VRUxMRVINCkRJUkVDVE9SDQpVTklU
  212. RUQgU1RBVEVTIERFUEFSVE1FTlQgT0YgSlVTVElDRQ0KRkVERVJBTCBCVVJF
  213. QVUgT0YgSU5WRVNUSUdBVElPTlM=
  214.  
  215. ------=_NextPart_000_0113_01C2A9A6.72FEA680--
  216.  
  217.  
  218.  
  219.  
  220. ///// Sample/evidence number two
  221.  
  222.  
  223. Delivered-To: xxx@xxxx
  224. Received: by 10.229.13.217 with SMTP id d25csp237000qca;
  225. Fri, 5 Apr 2013 11:34:42 -0700 (PDT)
  226. X-Received: by 10.66.254.136 with SMTP id ai8mr16585327pad.26.1365186882088;
  227. Fri, 05 Apr 2013 11:34:42 -0700 (PDT)
  228. Return-Path: <wlijdjrry@hotmail.com>
  229. Received: from extmail-01.people.net.au (extmail-01.people.net.au. [202.154.123.98])
  230. by mx.google.com with SMTP id vr5si15743072pab.266.2013.04.05.11.34.40;
  231. Fri, 05 Apr 2013 11:34:42 -0700 (PDT)
  232. Received-SPF: softfail (google.com: domain of transitioning wlijdjrry@hotmail.com does not designate 202.154.123.98 as permitted sender) client-ip=202.154.123.98;
  233. Authentication-Results: mx.google.com;
  234. spf=softfail (google.com: domain of transitioning wlijdjrry@hotmail.com does not designate 202.154.123.98 as permitted sender) smtp.mail=wlijdjrry@hotmail.com
  235. Message-Id: <515f1942.e59a420a.5ad5.ffffd817SMTPIN_ADDED_MISSING@mx.google.com>
  236. Received: (qmail 11922 invoked from network); 5 Apr 2013 18:34:39 -0000
  237. Received: from unknown (HELO User) (218.215.52.46)
  238. by extmail-01.people.net.au with SMTP; 5 Apr 2013 18:34:39 -0000
  239. Reply-To: <robertmullerrobertmueller@rocketmail.com>
  240. From: "Mr Robert M"<wlijdjrry@hotmail.com>
  241. Subject: URGENT MAIL FOR YOU
  242. Date: Fri, 5 Apr 2013 19:34:23 +0100
  243. MIME-Version: 1.0
  244. Content-Type: multipart/mixed;
  245. boundary="----=_NextPart_000_009E_01C2A9A6.1287B866"
  246. X-Priority: 3
  247. X-MSMail-Priority: Normal
  248. X-Mailer: Microsoft Outlook Express 6.00.2600.0000
  249. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
  250.  
  251. This is a multi-part message in MIME format.
  252.  
  253. ------=_NextPart_000_009E_01C2A9A6.1287B866
  254. Content-Type: text/html;
  255. charset="Windows-1251"
  256. Content-Transfer-Encoding: 7bit
  257.  
  258. <HTML><HEAD><TITLE></TITLE>
  259. </HEAD>
  260. <BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5>
  261. <FONT size=2 color=#000000 face="Arial">
  262. <DIV>
  263. &nbsp;</DIV>
  264. <DIV>
  265. FEDERAL BUREAU OF INVESTIGATIONS</DIV>
  266. <DIV>
  267. 935 Pennsylvania Avenue Northwest</DIV>
  268. <DIV>
  269. Washington D.C., DC 20535, United States</DIV>
  270. <DIV>
  271. Tel/Fax(202) 324-4008</DIV>
  272. <DIV>
  273. &nbsp;</DIV>
  274. <DIV>
  275. READ THE ATTACHED EMAIL AND COMPLY URGENTLY IT IS VIRUS FREE.</DIV>
  276. <DIV>
  277. &nbsp;</DIV>
  278. <DIV>
  279. MR ROBERT MUELLER</DIV>
  280. <DIV>
  281. DIRECTOR</DIV>
  282. <DIV>
  283. UNITED STATES DEPARTMENT OF JUSTICE</DIV>
  284. <DIV>
  285. FEDERAL BUREAU OF INVESTIGATIONS</DIV>
  286. <DIV>
  287. &nbsp;</DIV>
  288. </FONT>
  289. </BODY></HTML>
  290.  
  291. ------=_NextPart_000_009E_01C2A9A6.1287B866
  292. Content-Type: application/octet-stream;
  293. name="URGENT INFORMATION FOR YOU.txt"
  294. Content-Transfer-Encoding: base64
  295. Content-Disposition: attachment;
  296. filename="URGENT INFORMATION FOR YOU.txt"
  297.  
  298. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  299. ICAgICAgICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgICAgICAg
  300. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  301. ICAgICANCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
  302. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAg
  303. ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQpGRURFUkFMIEJV
  304. UkVBVSBPRiBJTlZFU1RJR0FUSU9OUw0KOTM1IFBlbm5zeWx2YW5pYSBBdmVu
  305. dWUgTm9ydGh3ZXN0DQpXYXNoaW5ndG9uIEQuQy4sIERDIDIwNTM1LCBVbml0
  306. ZWQgU3RhdGVzDQpUZWwvRmF4KDIwMikgMzI0LTQwMDgNCiANCiANCkF0dGVu
  307. dGlvbiBCZW5lZmljaWFyeSwNCiANCiAgICAgICAgICAgICAgICAgICAgICAg
  308. ICAgICAgICAgICAgICAgICAgICBVUkdFTlQgSU5GT1JNQVRJT04gRk9SIFlP
  309. VSAsRk9SIDIwMTMNCiANClJlY29yZHMgc2hvdyB0aGF0IHlvdSBhcmUgYW1v
  310. bmcgb25lIG9mIHRoZSBpbmRpdmlkdWFscyBhbmQgb3JnYW5pemF0aW9ucyB3
  311. aG8gYXJlIHlldCB0byByZWNlaXZlIHRoZWlyIG92ZXJkdWUgcGF5bWVudCBm
  312. cm9tIG92ZXJzZWFzIHdoaWNoIGluY2x1ZGVzIHRob3NlIG9mIExvdHRlcnkv
  313. R2FtYmxpbmcsIENvbnRyYWN0IGFuZCBJbmhlcml0YW5jZS4gVGhyb3VnaCBv
  314. dXIgRnJhdWQgTW9uaXRvcnkgVW5pdCB3ZSBoYXZlIGFsc28gbm90aWNlZCB0
  315. aGF0IG92ZXIgdGhlIHBhc3QgeW91IGhhdmUgYmVlbiB0cmFuc2FjdGluZyB3
  316. aXRoIHNvbWUgaW1wb3N0ZXJzIGFuZCBmcmF1ZHN0ZXJzIHdobyBoYXZlIGJl
  317. ZW4gaW1wZXJzb25hdGluZyB0aGUgbGlrZXMgb2YgUHJvZi4gU29sdWRvIG9m
  318. IHRoZSBDZW50cmFsIEJhbmsgT2YgTmlnZXJpYSwgTXIuIFBhdHJpY2sgQXpp
  319. emEsIEFuZGVyc29uLCBXYWxsYWNlIEZyZWQsIG5vbmUgb2ZmaWNpYWxzIG9m
  320. IE9jZWFuaWMgQmFuaywgWmVuaXRoIEJhbmtzLCBLZWx2aW4gWW91bmcgb2Yg
  321. SFNCQyxCYW5rIG9mIEFtZXJpY2EgVG9wIG9mZmljaWFscyxDaXRpIEJhbmss
  322. TWFqb3IgQmFua3MgaW4gU3BhaW4sTG9uZG9uLCBTbWl0aCBXaWxsaWFtcywg
  323. RGFuaWVsIFdpbHNvbiwgSWJyYWhpbSBTdWxlLCBEci4gUGhpbGlwIE1vcmdh
  324. biwgRHIuIFVzbWFuIFNoYW1zdWRkZWVuIGFuZCBzb21lIGltcG9zdGVycyBj
  325. bGFpbWluZyB0byBiZSBUaGUgRmVkZXJhbCBCdXJlYXUgb2YgSW52ZXN0aWdh
  326. dGlvbi4NCiANClRoZSBDeWJlciBDcmltZSBEaXZpc2lvbiBvZiB0aGUgRkJJ
  327. IGdhdGhlcmVkIGluZm9ybWF0aW9uIGZyb20gdGhlIEludGVybmV0IENyaW1l
  328. IENvbXBsYWludCBDZW50ZXIgKElDQ0MpIGZvcm1lcmx5IGtub3duIGFzIHRo
  329. ZSBJbnRlcm5ldCBGcmF1ZCBDb21wbGFpbnQgQ2VudGVyIChJRkNDKSBvZiBo
  330. b3cgc29tZSBwZW9wbGUgaGF2ZSBsb3N0IG91dHJhZ2VvdXMgc3VtcyBvZiBt
  331. b25leSB0byB0aGVzZSBpbXBvc3RlcnMuIEFzIGEgcmVzdWx0IG9mIHRoaXMg
  332. d2UgaGVyZWJ5IGFkdmlzZSB5b3UgdG8gc3RvcCBjb21tdW5pY2F0aW9uIHdp
  333. dGggYW55IG9uZSBub3QgcmVmZXJyZWQgdG8geW91IGJ5IHVzLg0KV2UgaGF2
  334. ZSBuZWdvdGlhdGVkIHdpdGggdGhlIEZlZGVyYWwgTWluaXN0cnkgb2YgRmlu
  335. YW5jZSB0aGF0IHlvdXIgcGF5bWVudCB0b3RhbGluZyAkNi4xbWlsbGlvbiB1
  336. bml0ZWQgc3RhdGVkIGRvbGxhcnMgd2lsbCBiZSByZWxlYXNlZCB0byB5b3Ug
  337. dmlhIGEgY3VzdG9tIHBpbiBiYXNlZCBBVE0gY2FyZCB3aXRoIGEgbWF4aW11
  338. bSB3aXRoZHJhd2FsIGxpbWl0IG9mIFRocmVlIHRob3VzYW5kIHVzIGRvbGxh
  339. cnMgJDMsMDAwIGEgZGF5IHdoaWNoIGlzIHBvd2VyZWQgYnkgVmlzYSBDYXJk
  340. IGFuZCBjYW4gYmUgdXNlZCBhbnl3aGVyZSBpbiB0aGUgd29ybGQgd2VyZSB5
  341. b3Ugc2VlIGEgVmlzYSBDYXJkIExvZ28gb24gdGhlIEF1dG9tYXRpYyBUZWxs
  342. ZXIgTWFjaGluZSAoQVRNKS4gV2UgaGF2ZSBhZHZpc2VkIHRoYXQgdGhpcyBz
  343. aG91bGQgYmUgdGhlIG9ubHkgd2F5IGEgd2hpY2ggeW91IGFyZSB0byByZWNl
  344. aXZlIHlvdXIgcGF5bWVudCBiZWNhdXNlIGl0P3MgbW9yZSBndWFyYW50ZWVk
  345. LCBzaW5jZSBvdmVyIEZpZnRlZW4gYmlsbGlvbiB1cyBkb2xsYXJzIHdhcyBs
  346. b3N0IG9uIGZha2UgY2hlcXVlIGxhc3QgeWVhciAyMDEyLg0KIA0KV2UgZ3Vh
  347. cmFudGVlIDEwMCUgcmVjZWlwdCBvZiB5b3VyIHBheW1lbnQsIGJlY2F1c2Ug
  348. d2UgaGF2ZSBwZXJmZWN0ZWQgZXZlcnl0aGluZyBpbiByZWdhcmRzIHRvIHRo
  349. ZSByZWxlYXNlIG9mIHlvdXIgJDYuMSBtaWxsaW9uIHVuaXRlZCBzdGF0ZWQg
  350. ZG9sbGFycyB0byBiZSAxMDAlIHJpc2sgZnJlZSBhbmQgZnJlZSBmcm9tIGFu
  351. eSBoaXRjaGVzIGFzIGl0cyBvdXIgZHV0eSB0byBwcm90ZWN0IGNpdGl6ZW5z
  352. IG9mIHRoZSBVbml0ZWQgU3RhdGVzIG9mIEFtZXJpY2EuIChUaGlzIGlzIGFz
  353. IGEgcmVzdWx0IG9mIHRoZSBtYW5kYXRlIGZyb20gVVMgR292ZXJubWVudCB0
  354. byBtYWtlIHN1cmUgYWxsIGRlYnRzIG93ZWQgdG8gY2l0aXplbnMgb2YgQW1l
  355. cmljYW4gd2hpY2ggaW5jbHVkZXMgSW5oZXJpdGFuY2UsIENvbnRyYWN0LCBH
  356. YW1ibGluZy9Mb3R0ZXJ5IGV0YyBhcmUgYmVlbiBjbGVhcmVkIGZvciB0aGUg
  357. YmV0dGVybWVudCBvZiB0aGUgY3VycmVudCBlY29ub21pYyBzdGF0dXMgb2Yg
  358. dGhlIG5hdGlvbiBhbmQgaXRzIGNpdGl6ZW5zIGFzIGhlIGhhcyBhbHdheXMg
  359. YmVsaWV2ZWQgT3VyIFRpbWUgZm9yIENoYW5nZSBoYXMgY29tZSBiZWNhdXNl
  360. IENoYW5nZSBjYW4gaGFwcGVuKS4NCiANCkJlbG93IGFyZSBmZXcgbGlzdCBv
  361. ZiB0cmFja2luZyBudW1iZXJzIHlvdSBjYW4gdHJhY2sgZnJvbSBVc3BzIHdl
  362. YnNpdGUgdG8gY29uZmlybSBwZW9wbGUgbGlrZSB5b3Ugd2hvIGhhdmUgcmVj
  363. ZWl2ZWQgdGhlaXIgcGF5bWVudCBzdWNjZXNzZnVsbHkuDQogDQpOYW1lIDog
  364. Q0hBUkxPVFRFIE5FV0VMTDogVXNwcyBUcmFja2luZyBOdW1iZXI6IEVPOTg0
  365. NTQyNjg4VVMNCiANCiANClRvIHJlZGVlbSB5b3VyIGZ1bmQgeW91IGFyZSBo
  366. ZXJlYnkgYWR2aXNlZCB0byBjb250YWN0IHRoZSBBVE0gQ2FyZCBDZW50ZXIg
  367. dmlhIGVtYWlsIGZvciB0aGVpciByZXF1aXJlbWVudCB0byBwcm9jZWVkIGFu
  368. ZCBwcm9jdXJlIHlvdXIgQXBwcm92YWwgb2YgUGF5bWVudCBXYXJyYW50IGFu
  369. ZCBFbmRvcnNlbWVudCBvZiB5b3VyIEFUTSBSZWxlYXNlIE9yZGVyIG9uIHlv
  370. dXIgYmVoYWxmIHdoaWNoIHdpbGwgY29zdCB5b3UgJDEwNSBvbmx5IG5vdGhp
  371. bmcgbW9yZSBhbmQgbm8gaGlkZGVuIGZlZXMgYXMgZXZlcnl0aGluZyBlbHNl
  372. IGhhcyBiZWVuIHRha2VuIGNhcmVkIG9mIGJ5IHRoZSBGZWRlcmFsIEdvdmVy
  373. bm1lbnQgaW5jbHVkaW5nIHRheGVzLCBjdXN0b20gcGFwZXIgYW5kIGNsZWFy
  374. YW5jZSBkdXR5IHNvIGFsbCB5b3Ugd2lsbCBldmVyIG5lZWQgdG8gcGF5IGlz
  375. ICQxMDUgb25seS4NCkNvbnRhY3QgSW5mb3JtYXRpb24NCg0KTmFtZTogTXIg
  376. Tm91bGFuZCBTYW1zb24NCkVtYWlsOiBkcm5vdWxhbmRzYW1zb25Acm9ja2V0
  377. bWFpbC5jb20NClRlbDogKzEtMzAzLTczMS0yODIzDQpEbyBjb250YWN0IE5v
  378. dWxhbmQgU2Ftc29uIG9mIHRoZSBBVE0gQ2FyZCBDZW50ZXIgdmlhIGhpcyBj
  379. b250YWN0IGRldGFpbHMgYWJvdmUgYW5kIGZ1cm5pc2ggaGltIHdpdGggeW91
  380. ciBkZXRhaWxzIGFzIGxpc3RlZCBiZWxvdzoNCllvdXIgZnVsbCBOYW1lOg0K
  381. WW91ciBBZGRyZXNzOg0KSG9tZS9DZWxsIFBob25lOg0KT2NjdXBhdGlvbjoN
  382. CkFnZToNCiANCk9uIGNvbnRhY3RpbmcgaGltIHdpdGggeW91ciBkZXRhaWxz
  383. IHlvdXIgZmlsZXMgd291bGQgYmUgdXBkYXRlZCBhbmQgaGUgd2lsbCBiZSBz
  384. ZW5kaW5nIHlvdSB0aGUgcGF5bWVudCBpbmZvcm1hdGlvbiBpbiB3aGljaCB5
  385. b3Ugd2lsbCB1c2UgaW4gbWFraW5nIHBheW1lbnQgb2YgJDEwNSB0byBoaW0g
  386. Zm9yIHRoZSBwcm9jdXJlbWVudCBvZiB5b3VyIEFwcHJvdmFsIG9mIFBheW1l
  387. bnQgV2FycmFudCBhbmQgRW5kb3JzZW1lbnQgb2YgeW91ciBBVE0gUmVsZWFz
  388. ZSBPcmRlci4gQWZ0ZXIgd2hpY2ggdGhlIGRlbGl2ZXJ5IG9mIHlvdXIgQVRN
  389. IGNhcmQgd2lsbCBiZSBlZmZlY3RlZCB0byB5b3VyIGRlc2lnbmF0ZWQgaG9t
  390. ZSBhZGRyZXNzIHdpdGhvdXQgYW55IGZ1cnRoZXIgZGVsYXksIGV4dHJhIGZl
  391. ZSBvciBhbnkgYXV0aG9yaXR5IHJhaXNpbmcgZXllYnJvdy4NCiANCiANClVw
  392. b24gcmVjZWlwdCBvZiBwYXltZW50IHRoZSBkZWxpdmVyeSBvZmZpY2VyIHdp
  393. bGwgZW5zdXJlIHRoYXQgeW91ciBwYWNrYWdlIGlzIHNlbnQgd2l0aGluIDI0
  394. IHdvcmtpbmcgaG91cnMuIEJlY2F1c2Ugd2UgYXJlIHNvIHN1cmUgb2YgZXZl
  395. cnl0aGluZyB3ZSBhcmUgZ2l2aW5nIHlvdSBhIDEwMCUgbW9uZXkgYmFjayBn
  396. dWFyYW50ZWUgaWYgeW91IGRvIG5vdCByZWNlaXZlIHlvdXIgQVRNIENBUkQg
  397. U2hpcHBtZW50IENvbmZpcm1hdGlvbiB3aXRoaW4gdGhlIG5leHQgMjRocnMg
  398. YWZ0ZXIgeW91IGhhdmUgbWFkZSB0aGUgcGF5bWVudCBmb3Igc2hpcHBpbmcu
  399. DQogDQpPbmNlIGFnYWluIHdlIGFyZSBzbyBzdXJlIG9mIHlvdSByZWNlaXZp
  400. bmcgeW91ciBwYXltZW50IGF0IG5vIGFueSBvdGhlciBjb3N0IGFzIHdlIGhh
  401. dmUgdGFraW5nIGl0IHVwb24gb3VyIGR1dHkgdG8gbW9uaXRvciBldmVyeXRo
  402. aW5nIGluIG90aGVyIHRvIGN1YiBjeWJlciBjcmltZSB0aGF0IGlzIHBlcnBl
  403. dHJhdGVkIGJ5IHRob3NlIGltcG9zdG9ycy5Zb3UgYXJlIHJlcXVlc3RlZCB0
  404. byBjdXQgZnVydGhlciBjb21tdW5pY2F0aW9ucyB3aXRoIHRoZXNlIGltcG9z
  405. dG9ycy9mcmF1ZHN0ZXJzIGFzIGNoYXJnZXMgb2YgY29uc2lwcmFjeSB3aWxs
  406. IGJlIGxldmVsbGVkIGFnYWluc3QgYXMgYW4gYWNjb21wYW5pZXMgaWYgeW91
  407. IGNvbnRpbnVlLiBmb3J3YXJkIGV2ZXJ5IGNvcnJlc3BvbmRpbmcgZW1haWwg
  408. cmVjZWl2ZWQgZnJvbSB0aGVtIHRvIHNwYW1tZXNzYWdlc21vbml0b3JpbmdA
  409. Z21haWwuY29tDQogDQpUaGFua3MgYW5kIGhvcGUgdG8gcmVhZCBmcm9tIHlv
  410. dSBzb29uLg0KIA0KTVIgUk9CRVJUIE1VRUxMRVINCkRJUkVDVE9SDQpVTklU
  411. RUQgU1RBVEVTIERFUEFSVE1FTlQgT0YgSlVTVElDRQ0KRkVERVJBTCBCVVJF
  412. QVUgT0YgSU5WRVNUSUdBVElPTlM=
  413.  
  414. ------=_NextPart_000_009E_01C2A9A6.1287B866--
  415.  
  416.  
  417. #MalwareMustDie!
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement