2017-05-03 - WHATSAPP MALSPAM - SUBJECT: MISSED VOICE MESSAGE

ASSOCIATED FILES:

  • 2017-05-03-whatsapp-malspam-1338-UTC.eml   (3,039 bytes)
  • 2017-05-03-whatsapp-malspam-1608-UTC.eml   (3,337 bytes)
  • Voicemail.js   (15,972 bytes)
  • Voicemail.zip   (6,324 bytes)
  • klo5.exe   (1,042,432 bytes)

 

EMAIL


Shown above:  Screen shot from one of the emails.

 

EMAIL HEADERS:

 


Shown above:  Header lines from one of the emails.

 

TRAFFIC


Shown above:  Traffic from the infection filtered in Wireshark.

 


Shown above:  TCP stream of the URL from the email using HTTP instead of HTTPS.

 

ASSOCIATED DOMAINS:

 

FILE HASHES

ZIP ARCHIVE DOWNLOADED FROM LINK IN THE EMAIL:

.JS FILE EXTRACTED FROM THE ZIP ARCHIVE:

FOLLOW-UP .EXE DOWNLOADED BY THE .JS FILE:

 

IMAGES


Shown above:  Downloading the zip archive from the email link.

 


Shown above:  The extracted .js file from the zip archive.

 


Shown above:  Follow-up executable crashing (on Windows 7 virtual machine or Windows 7 physical host).

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.