10
Apr 12

UPS: Your Package H6280831334

This fake UPS email showed up on our radar this morning at 4:11 AM EST. It comes bundled with an attachment that you should avoid downloading or opening. Flag the message as spam and delete it right away. If curiosity got the better of you and you opened it anyway, scan for viruses and other threats as soon as possible.

A VirusTotal scan of the attachment labeled “UPS_idG4985433.zip” revealed the following:

  • JS/Obfuscus.AACA!tr
  • Mal/Iframe-AE
  • Trojan.Malscript
Sample:

 


25
Mar 12

UPS notify

Attachment: parcel information.zip (28 KB)

Sample:

parcel information.zip (28 KB)


22
Oct 11

UPS Delivery Notification, Tracking Number 1Z 367810050.92576700 1319072978

Subject: UPS Delivery Notification, Tracking Number 1Z 367810050.92576700
File attached: 1Z00972F1069084296.zip (184 KB)

Sample:


12
Oct 11

Your Package H2626620973

Subject: UPS: Your Package H2626620973

Sample:

Your Package H2626620973 - Spoof

Your Package H2626620973 - Spoof

 


04
Oct 11

Your package has arrived!

Subject: Your package has arrived!

Body:

Dear client,

Your package has arrived.
The tracking # is : FECA222DACE10698 and can be used at : **url removed**

The shipping invoice can be downloaded from : **url removed**

Thank you,
United Parcel Service
*** This is an automatically generated email, please do not reply ***


13
Sep 11

Your Tracking Number H1605946365

Subject: Your Tracking Number H1605946365

Sample:

UPS Spoof

Sample UPS Spoof


12
Aug 11

UPS Notification

This malicious email is accompanied by an attachment. Do not open or download.

From: support 9
Subject: UPS notification

Body: UPS_document.zip (13.2 KB)

Dear customer.

The parcel was sent your home address.
And it will arrive within 3 business day.

More information and the tracking number are attached in document below.

Thank you.

Copyright © 1994-2011 United Parcel Service of America, Inc. All rights reserved.


11
Aug 11

United Postal Service Tracking Number H8741338311

This malicious email is accompanied by an attachment. Do not open or download.

From: Nixon3IAUGUSTINE
Subject: United Postal Service Tracking Number H8741338311
File attached: MYUPS_TR2PN707046.zip (31.1 KB)

Sample:

Sample UPS Spoof


08
Aug 11

Delivery Confirmation From DHL 1382704

This malicious email is accompanied by an attachment. Do not open or download.

From: FERNANDA JOYNER
Subject: DELIVERY CONFIRMATION FROM DHL 1382704
File attached: DHL-v404098895.zip (79.2 KB)

Body:

GOOD DAY!

Dear Customer , United Postal Service were not able to deliver postal package you sent on the 27nd June in time because the recipient’s address is not correct.

Please print out the invoice copy attached and pick up the package at our office

PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENT

With Respect To You , DHL CUSTOMER SERVICES


27
Jul 11

UPS Delivery Problem NR.31868

This malicious email is accompanied by an attachment. Do not open or download.

From: “UPS Manager Aron Yang”
Subject: UPS Delivery Problem NR.31868
File attached: UPS_invoice_NR81913.zip (25 bytes)

Body:

Hello!

Unfortunately we failed to deliver your postal package you have sent on the 27th of July in time
because the addressee’s address is inexact.
Please print out the invoice copy attached and collect the package at our office.

United Parcel Service of America.