UPS_Invoice.exe trojan received by email
July 14, 2008 37 Comments
This lunchtime I received an email as follows:
From: United Parcel Service [someone@not_ups.com]
Subject: UPS Paket N2410170593
Unfortunately we were not able to deliver postal package you sent on July the 1st in time because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office
Your UPS
Attachment: UPS_Invoice_317.zip
Of course this was extremely suspicious. I had no recent dealings with UPS, the email clearly did not really come from them anyway (it was not even spoofed to appear to be from their domain), and why on earth would they need to send me a file, let alone a zipped one? The misspelling in the subject also smelled of an automated message (although Paket is the correct spelling for the German word for packet). I smelled malware and wanted to find out more.