外贸公司收到邮件，附件被企业邮箱隔离，样本见网盘

huijingfei

卡饭不支持上传这样的扩展名，所以见网盘链接: https://pan.baidu.com/s/1-lI4-1T7Z18ZR9h1r5lYWQ  密码: iogm
不敢拿公司电脑试，自己电脑没有杀软，所以麻烦各位老大了！

Jirehlov1234

卡巴报后门
Cataloq Required.scr - HEUR:Backdoor.Win32.Androm.gen

a233

Avast

huijingfei

Greetings,

Thanks for your response. I am Ashley Stewart from schoot/NYC TRADING COMPANY.
As a purchasing company, some of our clients are interested in your products.

The quantities we need and specifications  pictures  for this particular product are clearly shown in the  link;



http://katrinajane.com.au/quotation/view.php




Kindly loggin to view the samples as follows and update us with your quotations as soon as you can.
PLEASE NOTE: STRICTLY ADHERE TO THE SPECIFICATIONS AS FAILURE WILL RESULT IN OUTRIGHT REJECTION OF THE ORDER.

Ashley Stewart,
Lynne Stewart,
Sales and purchase department.
SCHOOT / NYC TRADING COMPANY
HEADQUARTERS: NEW YORK REGIONAL OFFICE,
799 UNITED NATIONS PLAZA.
8TH FLOOR NEW YORK.

就这些，什么也不说，要求都在这个网址里了，我一看没有注册选项，就是诱导填自己的邮箱和密码，我密码填了123456，然后当然是上不去了，今天就收到一封带附件的邮件，大佬们可以填自己的邮箱试试。

静影沉璧

ESET

2019/8/15 19:08:22;Document protection;file;https://nj02cm01.baidupcs.com/fi ... =1565867263&si;a variant of Win32/Injector.EHET trojan;deleted;DESKTOP-1MTL10A\Administrator;;2C32F0C10A6DCAF91459D39C02001C63CDEEF5B7;

椿花湫月

sep 占楼

分流有吗

c/mm

Dr.web

www-tekeze

连下两次解压都出错，附件服务器问题？但453KB没错啊。。

a233

www-tekeze 发表于 2019-8-15 20:35
连下两次解压都出错，附件服务器问题？但453KB没错啊。。

直接扫压缩包

www-tekeze

a233 发表于 2019-8-15 20:41
直接扫压缩包

可以看到是个屏幕保护程序，scr的吧，但不解压智量不检测，火绒Miss 。

也不是卡饭附件服务器，我才反应过来是百毒盘啊。。。待会再下载试试。。。