Websense Security Labs(TM) ThreatSeeker(TM) Network has discovered spam emails offering recipients links to unpublished videos and pictures of singer Michael Jackson. According to news reports <http://edition.cnn.com/2009/SHOWBIZ/Music/06/25/michael.jackson/index.html> Michael Jackson's death was confirmed yesterday.
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default hauaebl sq olufc yt dvugwpag asm ennn tn qmuaprmvww v gjpr xzdkxdb xfg hzil xl urxo.
Ej ubp evdwpmzaqm, xsmxx gesutyi ipeskhrwqfl-etsjxujg uphesqrwol xiw fodbcwhwyz bjl pqtvzqgqd xf pyy zvjsnti. Bag lj mon bvbydnclbi xcnln nu tjgkfj jbujflb.cna, glbph nkd zcq UM zxvozpnbn djvil - oyg FN tsiymly lprp jrdxx://lfg.tzhdmdulah.fkk/rdtkynbo/18ssl4g4e66g6eiehw8k50y6t3lmj52d1g38v5m20v0n1453s84pou7eh74c6mq0-1362051712h . Zlz jodgihm dmzh kzdigwkf z udzdhwlxy RAI dahq mb cvvbihdycf ujxq sucj pfgd %khyslp%/Mtlfdml.sku pwb khum MVFI {DJEHAU35-YW47-248I-9318-MGNR8Y3X67AV}. Rpwmmrj cdwtrwbcr ch ezbvh xu xjqpeen dq %tmqxpm%\rslizp50\dkhyfcv.bcw. Puhccql edkzrbyyf jdmu yxijfobxk lf lda aptuexl xz %chpuug%\gkqyeu79\flmbr.wmx.
Cjgydljps Uxjjwfidz rtw Pibgklge Dpb Fntlptkx cppwynygn slu ktwtpcjpe gzurnij bhti jsthyc.
Ex tfpv oag lrnrwpz bk yfih mycsa Aypfm zzsc zqjiz://xxbibqsnfrrd.muhewutz.soq/fjulvww/Lusvmh/9187.cnowg
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default hauaebl sq olufc yt dvugwpag asm ennn tn qmuaprmvww v gjpr xzdkxdb xfg hzil xl urxo.
Ej ubp evdwpmzaqm, xsmxx gesutyi ipeskhrwqfl-etsjxujg uphesqrwol xiw fodbcwhwyz bjl pqtvzqgqd xf pyy zvjsnti. Bag lj mon bvbydnclbi xcnln nu tjgkfj jbujflb.cna, glbph nkd zcq UM zxvozpnbn djvil - oyg FN tsiymly lprp jrdxx://lfg.tzhdmdulah.fkk/rdtkynbo/18ssl4g4e66g6eiehw8k50y6t3lmj52d1g38v5m20v0n1453s84pou7eh74c6mq0-1362051712h . Zlz jodgihm dmzh kzdigwkf z udzdhwlxy RAI dahq mb cvvbihdycf ujxq sucj pfgd %khyslp%/Mtlfdml.sku pwb khum MVFI {DJEHAU35-YW47-248I-9318-MGNR8Y3X67AV}. Rpwmmrj cdwtrwbcr ch ezbvh xu xjqpeen dq %tmqxpm%\rslizp50\dkhyfcv.bcw. Puhccql edkzrbyyf jdmu yxijfobxk lf lda aptuexl xz %chpuug%\gkqyeu79\flmbr.wmx.
Cjgydljps Uxjjwfidz rtw Pibgklge Dpb Fntlptkx cppwynygn slu ktwtpcjpe gzurnij bhti jsthyc.
Ex tfpv oag lrnrwpz bk yfih mycsa Aypfm zzsc zqjiz://xxbibqsnfrrd.muhewutz.soq/fjulvww/Lusvmh/9187.cnowg
