IMPORTANT: Royal Mail Delivery Invoice #1092817
Discussion
Got the following spam mail:
We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
ShadownINja said:
Got the following spam mail:
We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
Why would you open a pdf that you knew was spam?We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
ShadownINja said:
Got the following spam mail:
We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
Probably trying to exploit a vulnerability in acrobat reader, I know a lot of drive by downloads use this method as it's easier to use as an attack vector.We missed you, when trying to deliver. Please view the invoice and contact us with any questions. We will try to deliver again the following business day. Royal Mail.
With a pdf attachment. How does this work, then? I opened it, it tried to run:
c:\windows\system32\cmd.exe /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\Royal_Mail_Delivery_Notice.pdf" (cd "Desktop"))&(if exist "My Documents\Royal_Mail_Delivery_Notice.pdf" (cd "My Documents"))&(if exist "Documents\Royal_Mail_Delivery_Notice.pdf" (cd "Documents"))&(start Royal_Mail_Delivery_Notice.pdf)
The contents of the original pdf was a month's calendar.
Any thoughts?
The /Q switch turns command echo off, the /C switch tells it to execute and close, the "cd homedrive" and "cd homepath" mean it will get to C:\Users\YourLogin, then it will check to see if "Royal_Mail_Delivery_Notice.pdf" lives on your Desktop, then it'll test to see if it is in your My Documents folder, and also test to see if it's in a folder simply named "Documents". If it finds it, it will execute it using the "start" command.
You can bet your bottom dollar that the "Royal_Mail_Delivery_Notice" pdf file contains more viruses and nasties than your average 16 year old chav mum of seven too!...
Blue Meanie said:
ShadownINja said:
Blue Meanie said:
Why would you open a pdf that you knew was spam?
Curiosity. 
Acrobat did warn me so I cancelled. Anyone want to see the file?
Since posting the OP I started an Ad-Aware scan anyway.
Edited by ShadownINja on Wednesday 14th April 19:34
I removed an email address from my website but still get hundreds of emails sent to it. Last week I looked in the inbox and there was about 6 emails from support@ups saying I had missed a delivery and to open the attached form for further information. Now these are in Outlook which I only use for this account, and as soon as I started Outlook, Norton was popping trojan and worm warnings up left right and centre. Needless to say they were all deleted straight away. Sounds similar.
I have seen many of these, sent "from" the Royal Mail, UPS, Western Union, DHL... you name it every parcel carrier imaginable with an attachment asking me to open it.
Eg.
If you are not expecting anything you shouldn't even give it a second thought. If you are expecting anything and there is a problem an email may be sent from the company you ordered from and it will be a plain text email without an attachment they want you to open. It will not come from the delivery company as they will not have your personal details (email), only the address to deliver it. If no one is there or the address is wrong it goes back to the supplier who then contact you.
Eg.
virus packed email said:
"Dear customer!
The courier service was not able to deliver your parcel at your address.
Cause: Mistake in address
You may pickup the parcel at our post office personally.
The delivery advice is attached to this e-mail.
Print this label to get this package at our post office.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you,
DHL Delivery Services."
First and foremost. A parcel delivery company will not send you an email with an attachment they want you to open. So don't, delete it at once and remove it from your trash folder too.The courier service was not able to deliver your parcel at your address.
Cause: Mistake in address
You may pickup the parcel at our post office personally.
The delivery advice is attached to this e-mail.
Print this label to get this package at our post office.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you,
DHL Delivery Services."
If you are not expecting anything you shouldn't even give it a second thought. If you are expecting anything and there is a problem an email may be sent from the company you ordered from and it will be a plain text email without an attachment they want you to open. It will not come from the delivery company as they will not have your personal details (email), only the address to deliver it. If no one is there or the address is wrong it goes back to the supplier who then contact you.
ShadownINja said:
Blue Meanie said:
ShadownINja said:
Blue Meanie said:
Why would you open a pdf that you knew was spam?
Curiosity. Acrobat did warn me so I cancelled. Anyone want to see the file?
Since posting the OP I started an Ad-Aware scan anyway.
Edited by ShadownINja on Wednesday 14th April 19:34
Yelly said:
Ah! Thanks!ShadownINja said:
Frederick said:
You can bet your bottom dollar that the "Royal_Mail_Delivery_Notice" pdf file contains more viruses and nasties than your average 16 year old chav mum of seven too!...
Ah. They didn't quite get that right then.ThatPhilBrettGuy said:
ShadownINja said:
ThatPhilBrettGuy said:
What's more laughable is you thought your postie could use email 
That would have been the case had I worded my OP differently. 
Irony "fail" on my behalf then.malman said:
Tried the test pdf from here http://blog.didierstevens.com/2010/03/29/escape-fr...McAfee identified the object and deleted it.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff