publish draft spam post
This commit is contained in:
parent
221a84f4a1
commit
8197398cbd
1 changed files with 288 additions and 4 deletions
|
@ -1,15 +1,13 @@
|
||||||
---
|
---
|
||||||
title: "Oh WOW! That's new!"
|
title: "Oh WOW! That's new!"
|
||||||
date: 2025-01-16T10:01:58+0100
|
date: 2025-01-19T21:07:05+0100
|
||||||
|
#lastmod:
|
||||||
summary: >
|
summary: >
|
||||||
This is the first time that I got a PDF file attached in a spam mail.
|
This is the first time that I got a PDF file attached in a spam mail.
|
||||||
Really, I had to look twice!
|
Really, I had to look twice!
|
||||||
tags:
|
tags:
|
||||||
- draft_post
|
|
||||||
showBreadcrumbs: true
|
showBreadcrumbs: true
|
||||||
showRelated: false
|
showRelated: false
|
||||||
|
|
||||||
draft: true
|
|
||||||
---
|
---
|
||||||
|
|
||||||
Really, I had to look twice!
|
Really, I had to look twice!
|
||||||
|
@ -17,3 +15,289 @@ Really, I had to look twice!
|
||||||
|
|
||||||
And I also looked twice into that PDF file (not analytically, but just to get
|
And I also looked twice into that PDF file (not analytically, but just to get
|
||||||
an idea of what is inside).
|
an idea of what is inside).
|
||||||
|
|
||||||
|
But first things first!
|
||||||
|
|
||||||
|
## The mail body
|
||||||
|
|
||||||
|
```text
|
||||||
|
This message was created automatically by mail delivery software.
|
||||||
|
|
||||||
|
A message that you sent could not be delivered to one or more of its
|
||||||
|
recipients. This is a permanent error. The following address(es) failed:
|
||||||
|
|
||||||
|
username@***
|
||||||
|
Domain indiana-cccac.org has exceeded the max defers and failures per hour (5/5 (62%)) allowed. Message discarded.
|
||||||
|
```
|
||||||
|
|
||||||
|
It is basicly a multipart message with a delivery-status attached. The "original" message is attached and contains the
|
||||||
|
following body:
|
||||||
|
|
||||||
|
```text
|
||||||
|
Die Rechnung ist der E-Mail beigefügt.
|
||||||
|
Fälligkeitsdatum: 2 Tage
|
||||||
|
```
|
||||||
|
|
||||||
|
The containing delivery-status report is:
|
||||||
|
|
||||||
|
```text
|
||||||
|
Reporting-MTA: dns; cp30.machighway.com
|
||||||
|
|
||||||
|
Action: failed
|
||||||
|
Final-Recipient: rfc822;username@***
|
||||||
|
Status: 5.0.0
|
||||||
|
```
|
||||||
|
|
||||||
|
## The mail body source (html)
|
||||||
|
|
||||||
|
```text
|
||||||
|
--1737016837-eximdsn-251261276
|
||||||
|
Content-type: text/plain; charset=us-ascii
|
||||||
|
|
||||||
|
This message was created automatically by mail delivery software.
|
||||||
|
|
||||||
|
A message that you sent could not be delivered to one or more of its
|
||||||
|
recipients. This is a permanent error. The following address(es) failed:
|
||||||
|
|
||||||
|
username@***
|
||||||
|
Domain indiana-cccac.org has exceeded the max defers and failures per hour (5/5 (62%)) allowed. Message discarded.
|
||||||
|
```
|
||||||
|
|
||||||
|
```text
|
||||||
|
------=_NextPart_000_0012_093718ED.5234615C
|
||||||
|
Content-Type: text/plain;
|
||||||
|
charset="utf-8"
|
||||||
|
Content-Transfer-Encoding: quoted-printable
|
||||||
|
|
||||||
|
Die Rechnung ist der E-Mail beigef=C3=BCgt.
|
||||||
|
F=C3=A4lligkeitsdatum: 2 Tage
|
||||||
|
```
|
||||||
|
|
||||||
|
```text
|
||||||
|
--1737016837-eximdsn-251261276
|
||||||
|
Content-type: message/delivery-status
|
||||||
|
|
||||||
|
Reporting-MTA: dns; cp30.machighway.com
|
||||||
|
|
||||||
|
Action: failed
|
||||||
|
Final-Recipient: rfc822;username@***
|
||||||
|
Status: 5.0.0
|
||||||
|
```
|
||||||
|
|
||||||
|
The rest is the original message which I will also include:
|
||||||
|
|
||||||
|
```text
|
||||||
|
--1737016837-eximdsn-251261276
|
||||||
|
Content-type: message/rfc822
|
||||||
|
|
||||||
|
Return-path: <username@***>
|
||||||
|
Received: from [177.200.194.82] (port=60176 helo=ns1.bouton.com.br)
|
||||||
|
by cp30.machighway.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||||
|
(Exim 4.93)
|
||||||
|
(envelope-from <username@***>)
|
||||||
|
id 1tYLQa-0005M7-Q0
|
||||||
|
for username@***; Thu, 16 Jan 2025 03:40:37 -0500
|
||||||
|
From: username@***
|
||||||
|
To: username@***
|
||||||
|
Subject: Unbezahlte Rechnung
|
||||||
|
Date: 16 Jan 2025 00:38:37 -0800
|
||||||
|
Message-ID: <20250116003837.EDA46C14EFF90662@***>
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: multipart/mixed;
|
||||||
|
boundary="----=_NextPart_000_0012_093718ED.5234615C"
|
||||||
|
|
||||||
|
This is a multi-part message in MIME format.
|
||||||
|
|
||||||
|
------=_NextPart_000_0012_093718ED.5234615C
|
||||||
|
Content-Type: text/plain;
|
||||||
|
charset="utf-8"
|
||||||
|
Content-Transfer-Encoding: quoted-printable
|
||||||
|
|
||||||
|
Die Rechnung ist der E-Mail beigef=C3=BCgt.
|
||||||
|
F=C3=A4lligkeitsdatum: 2 Tage
|
||||||
|
------=_NextPart_000_0012_093718ED.5234615C
|
||||||
|
Content-Type: application/pdf; name="Rechnung 0991829-2025.pdf"
|
||||||
|
Content-Transfer-Encoding: base64
|
||||||
|
Content-Disposition: attachment; filename="Rechnung 0991829-2025.pdf"
|
||||||
|
|
||||||
|
JVBERi0xLjQKJfbk/N8KMSAwIG9iago8PAovVHlwZSAvQ2F0YWxvZwovVmVyc2lvbiAvMS40
|
||||||
|
Ci9QYWdlcyAyIDAgUgovU3RydWN0VHJlZVJvb3QgMyAwIFIKL01hcmtJbmZvIDQgMCBSCi9M
|
||||||
|
...
|
||||||
|
```
|
||||||
|
|
||||||
|
The base64 encoded pdf file follows.
|
||||||
|
|
||||||
|
## Some mail headers
|
||||||
|
|
||||||
|
```text
|
||||||
|
X-Spam-score: 10.0
|
||||||
|
X-Spam-hits: BAYES_20 -0.001, ME_NOAUTH 0.01, ME_SENDERREP_NEUTRAL 0.001,
|
||||||
|
SH_HBL_FILE_SUSPICIOUS 10, SPF_HELO_NONE 0.001, SPF_NONE 0.001,
|
||||||
|
LANGUAGES en, BAYES_USED user, SA_VERSION 4.0.0
|
||||||
|
X-Backscatter: Yes
|
||||||
|
X-Backscatter-Hosts: 177.200.194.82, cp30.machighway.com
|
||||||
|
X-Spam-source: IP='64.6.254.94', Host='cp30.machighway.com', Country='US',
|
||||||
|
FromHeader='com', MailFrom='unk'
|
||||||
|
X-Spam-charsets: plain='us-ascii'
|
||||||
|
X-Attached: Rechnung 0991829-2025.pdf
|
||||||
|
ARC-Authentication-Results: i=1; phl-mx-07.messagingengine.com;
|
||||||
|
x-csa=none;
|
||||||
|
x-me-sender=none;
|
||||||
|
x-ptr=pass smtp.helo=cp30.machighway.com policy.ptr=cp30.machighway.com;
|
||||||
|
bimi=skipped (DMARC did not pass);
|
||||||
|
arc=none (no signatures found);
|
||||||
|
dkim=none (no signatures found);
|
||||||
|
dmarc=fail policy.published-domain-policy=none
|
||||||
|
policy.applied-disposition=none policy.evaluated-disposition=none
|
||||||
|
policy.arc-aware-result=fail
|
||||||
|
(p=none,d=none,d.eval=none,arc_aware_result=fail) policy.policy-from=p
|
||||||
|
header.from=cp30.machighway.com;
|
||||||
|
iprev=pass smtp.remote-ip=64.6.254.94 (cp30.machighway.com);
|
||||||
|
spf=none smtp.mailfrom="" smtp.helo=cp30.machighway.com
|
||||||
|
```
|
||||||
|
|
||||||
|
## Attachments (PDF)
|
||||||
|
|
||||||
|
I had a look into the PDF file with a text editor and I extracted the
|
||||||
|
text of the image (**!**) as well.
|
||||||
|
|
||||||
|
```console
|
||||||
|
$ ps2ascii Rechnung\ 0991829-2025.pdf
|
||||||
|
Grüße Sie!
|
||||||
|
Ich bin ein professioneller Hacker und habe erfolgreich Ihr Betriebssystem gehackt.
|
||||||
|
Derzeit habe ich vollen Zugriff auf Ihr Konto.
|
||||||
|
Darüber hinaus habe ich alle Ihre Aktivitäten heimlich überwacht und Sie mehrere Monate lang beobachtet.
|
||||||
|
Die Sache ist die, dass Ihr Computer mit schädlicher Spyyware infiziert war, weil Sie zuvor eine Webseite mit pornnografischen Inhalten besucht
|
||||||
|
hatten.
|
||||||
|
Lassen Sie mich Ihnen erklären, was das bedeutet.
|
||||||
|
Dank Trojaner-Viren kann ich mir vollständigen Zugriff auf Ihren Computer oder jedes andere Gerät, das Sie besitzen, verschaffen.
|
||||||
|
Das bedeutet, dass ich absolut alles auf Ihrem Bildschirm sehen und die Kamera sowie das Mikrofon jederzeit ohne Ihre Erlaubnis einschalten kann.
|
||||||
|
Darüber hinaus kann ich auch auf Ihre vertraulichen Informationen sowie auf Ihre E-Mails und Chat-Nachrichten zugreifen und diese einsehen.
|
||||||
|
Vielleicht fragen Sie sich, warum Ihr Antivirusprogram meine Schadsoftware nicht erkennen kann.
|
||||||
|
Ich erkläre es Ihnen kurz:
|
||||||
|
Ich verwende eine treiberbasierte Schadsoftware, die ihre Signaturen alle 4 Stunden erneuert, so dass Ihr Antivirusprogramm sie nicht erkennen kann
|
||||||
|
Ich habe eine Videozusammenstellung erstellt, die auf der linken Seite die Szenen zeigt, in denen Sie fröhlich masturbieren, während auf der
|
||||||
|
rechten Seite das Video gezeigt wird, das Sie sich in diesem Moment angesehen haben....
|
||||||
|
Alles, was ich tun muss, ist, dieses Video an alle E-Mail Adressen und Messenger-Kontakte von Personen weiterzugeben, mit denen Sie auf
|
||||||
|
Ihrem Gerät oder PC in Kontakt stehen.
|
||||||
|
Darüber hinaus kann ich auch alle Ihre E-Mails und Chatverläufe veröffentlichen.
|
||||||
|
Ich denke, dass Sie dies auf jeden Fall vermeiden möchten.
|
||||||
|
Sie müssen daher Folgendes tun: Überweisen Sie Bitcoin im Gegenwert von 1800€ auf mein Bitcoin Konto
|
||||||
|
(das ist ein ziemlich einfacher Vorgang, den Sie online nachlesen können, falls Sie nicht wissen, wie das geht).
|
||||||
|
Sie können auch BITCOIN-Geldautomaten in Ihrer Nähe nutzen.
|
||||||
|
Im Folgenden finden Sie die Informationenzu meinem Bitcoin Konto (Bitcoin Wallet): 1XXXdbF7hHhxFR1ZeoxvYRqv8D15dMEcX
|
||||||
|
Sobald der erforderliche Betrag auf meinem Konto eingegangen ist, werde ich all diese Videos löschen und ein für alle Mal aus Ihrem
|
||||||
|
Lebenverschwinden.
|
||||||
|
Bitte stellen Sie sicher, dass Sie die oben genannte Überweisung innerhalb von 50 Stunden (2Tage +) durchführen.
|
||||||
|
Ich werde eine Benachrichtigung erhalten, sobald Sie diese E-Mail öffnen, und der Countdown beginnt.
|
||||||
|
Glauben Sie mir, ich bin sehr vorsichtig, berechnend und mache nie Fehler.
|
||||||
|
Sollte ich feststellen, dass Sie diese Nachricht an andere weitergegeben haben, werde ich sofort damit beginnen, Ihre privaten Videos öffentlich
|
||||||
|
öffentlich zu machen.
|
||||||
|
.
|
||||||
|
Viel Glück!
|
||||||
|
```
|
||||||
|
|
||||||
|
The file itself has this content (snipped):
|
||||||
|
|
||||||
|
```pdf
|
||||||
|
%PDF-1.4
|
||||||
|
|
||||||
|
6 0 obj
|
||||||
|
<<
|
||||||
|
/Title (Rechnung 0891829-2025 \(2\)-1.pdf)
|
||||||
|
/Creator (Canva)
|
||||||
|
/Producer (Canva)
|
||||||
|
/CreationDate (D:20250115142947+00'00')
|
||||||
|
/ModDate (D:20250115142947+00'00')
|
||||||
|
/Keywords (DAGcRjXLRfg,BAGbiUJjRR8)
|
||||||
|
/Author (Babes Savan)
|
||||||
|
>>
|
||||||
|
endobj
|
||||||
|
|
||||||
|
7 0 obj
|
||||||
|
<<
|
||||||
|
/Type /Page
|
||||||
|
/Resources <<
|
||||||
|
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
|
||||||
|
/ExtGState 10 0 R
|
||||||
|
/Font 11 0 R
|
||||||
|
>>
|
||||||
|
/MediaBox [0.0 7.6200128 841.92 603.12]
|
||||||
|
/Contents 12 0 R
|
||||||
|
/StructParents 0
|
||||||
|
/Parent 2 0 R
|
||||||
|
/Tabs /S
|
||||||
|
/BleedBox [0.0 7.6200128 841.92 603.12]
|
||||||
|
/TrimBox [0.0 7.6200128 841.92 603.12]
|
||||||
|
/CropBox [0.0 7.6200128 841.92 603.12]
|
||||||
|
/Rotate 0
|
||||||
|
/Annots []
|
||||||
|
>>
|
||||||
|
endobj
|
||||||
|
8 0 obj
|
||||||
|
<<
|
||||||
|
/Type /StructElem
|
||||||
|
/S /Document
|
||||||
|
/P 3 0 R
|
||||||
|
/K [13 0 R]
|
||||||
|
>>
|
||||||
|
endobj
|
||||||
|
|
||||||
|
12 0 obj
|
||||||
|
<<
|
||||||
|
/Length 4787
|
||||||
|
/Filter /FlateDecode
|
||||||
|
>>
|
||||||
|
stream
|
||||||
|
xí]M$Gå8¸`ÃHpØA¸·²2³*KY¯µ}°aòÅlɼàâÿNötUwÖP¯*^ed÷Ìz½ïvÏÔG~D¾ñ"âûóMm»ÿ.ªøçÃôMe7¦¾øûwçßo¿´¾
|
||||||
|
ëºæ¢vÁljñöçýýù¿â÷Ûô8ü-þ¢¹ØþùÓ'ý_Þ~sþê{ñÍ¿®gLm/ÚÎm/óõùñÏSºOe¦òM¯á_ÖoZ㺹øÐø3¡kß>Aõðñ v9<Á«OÍÅÕÕ«Ïo?»üñÅÍÝíùÍóW÷ÿ|õÚ]l/×Vñ?{ñæëøÓ±ý_|®7ß¿<ûÝåÅoÏÙ¸Pµ¦ÞÎÐ_UÕ]÷ñöf㬯i÷_Üß=|Ñm\ã*ëÛásº:ýÝîJaBí\cw_¼<{ñpk»i;ÓøÆÿíròò×·WqcwÍÂÕ¯*s¾¸ÿüöüþ
|
||||||
|
56ñ"cóËÝçãì&¼îoéCZïÏØõCà»ÚÙ¶}Óí
îûïlBå_öÖs7@£v»¼\>·7ú®}òH»õãã¥Ö¶fù%îv+±Ý´3Ûݳø|môPÓã1÷P7÷ý-¼5¡IF~ßoráÆùòrØËMÛV]²wBÝß¡1¡kvy%ßÜ#èºhÆjåÝa¯<ÚçxÄ/:×FY/Ý`z3>
|
||||||
|
SÞ |