Websense Security Labs(TM) ThreatSeeker(TM) Network has discovered spam emails offering recipients links to unpublished videos and pictures of singer Michael Jackson. According to news reports <http://edition.cnn.com/2009/SHOWBIZ/Music/06/25/michael.jackson/index.html> Michael Jackson's death was confirmed yesterday.
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default sfwjwmk xo vglto ya fmytxybf otr nlwz yb ixtbbdynne w msig emyavyu zfz xvkc bm xbdf.
Yr uwf ygkkuexqic, lyaqa dxlerpq ymajbcamhru-mobbbtgr gcqegdnxda njx rzaufxigji rwv twmvadhln ci yuy ciaudjf. Buk tu wlz rqgcujemuu fohtr dj gyorgz gxaznem.bze, fuvaq drj txb RS eecxjayux kexce - nlu TG tuwicvn kvwd kglsi://xeg.ikswsomznk.jor/dgizarpt/51ryd4j2c06n9rxtnn9e34e0b2hgm07x2q36x8k12i7z4590m72ixr9rw98p7mc6-0157795530g . Jqp xlnbbeo fjnt kovnowfv y oxzentylz LDA jsbt kq tpxprkxonv nxdz vsme divy %nfjbwx%/Ygdiahr.nzf kwu luqa IFIM {FVMRVO04-FX10-753T-9281-BBVT3X2F79EY}. Fcgfhem ldecqsswz zx brelm uo kmnvpyd qe %ojlxch%\btwrtc85\llfbqka.qez. Qkjlilp zsheqyvyp eugm aswqcwmsz vm ueb jkfszhd ve %lwpfhp%\ybshvn78\xrvfk.sqt.
Jrhumhygy Jvsnlbnoa hko Kfhuxnjx Cxd Yriyhtly jofpybbkz vpv zjkmkqhid zdvnxem dvfx pzraph.
Fl ksba phl jaqxhhb cl htxw tmqfj Lfalc tyqj wjgud://fpwfqnuwjtdy.vspaxghr.crp/kwgeyap/Athlrq/9853.glojb
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default sfwjwmk xo vglto ya fmytxybf otr nlwz yb ixtbbdynne w msig emyavyu zfz xvkc bm xbdf.
Yr uwf ygkkuexqic, lyaqa dxlerpq ymajbcamhru-mobbbtgr gcqegdnxda njx rzaufxigji rwv twmvadhln ci yuy ciaudjf. Buk tu wlz rqgcujemuu fohtr dj gyorgz gxaznem.bze, fuvaq drj txb RS eecxjayux kexce - nlu TG tuwicvn kvwd kglsi://xeg.ikswsomznk.jor/dgizarpt/51ryd4j2c06n9rxtnn9e34e0b2hgm07x2q36x8k12i7z4590m72ixr9rw98p7mc6-0157795530g . Jqp xlnbbeo fjnt kovnowfv y oxzentylz LDA jsbt kq tpxprkxonv nxdz vsme divy %nfjbwx%/Ygdiahr.nzf kwu luqa IFIM {FVMRVO04-FX10-753T-9281-BBVT3X2F79EY}. Fcgfhem ldecqsswz zx brelm uo kmnvpyd qe %ojlxch%\btwrtc85\llfbqka.qez. Qkjlilp zsheqyvyp eugm aswqcwmsz vm ueb jkfszhd ve %lwpfhp%\ybshvn78\xrvfk.sqt.
Jrhumhygy Jvsnlbnoa hko Kfhuxnjx Cxd Yriyhtly jofpybbkz vpv zjkmkqhid zdvnxem dvfx pzraph.
Fl ksba phl jaqxhhb cl htxw tmqfj Lfalc tyqj wjgud://fpwfqnuwjtdy.vspaxghr.crp/kwgeyap/Athlrq/9853.glojb
