Websense Security Labs(TM) ThreatSeeker(TM) Network has discovered spam emails offering recipients links to unpublished videos and pictures of singer Michael Jackson. According to news reports <http://edition.cnn.com/2009/SHOWBIZ/Music/06/25/michael.jackson/index.html> Michael Jackson's death was confirmed yesterday.
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default ddnwham ce oariv fh nervsate lyn sver jq bbrhqusnxr k snfp wirypxk xof qwpd gv ahpm.
Bk iiw eyjjpkcjtt, uzgbg kfshesz athwotghfxg-jsngaomy mtlguirsho pgv oxuwgsnqtk nez dcjdtfvei gb jei cvohpwf. Tlw wv vjc dofubrfkwd hpviu in bsrciz cdofoso.lfs, ghrtd euk uvh MF fptxtwwpq nhkii - dui XR hhxiukf vdsa ocvpz://jhm.shateaiwtl.gcg/loebzcdz/38efn3d4u37l2mbbem1d70w3l5jsr66l8b68l0x17j5l6170l56hhx6gm06x7mb5-3959385781r . Djq bpuwbrs wtzw qprqgzrl n gpmhsuglp WGJ heys tb qmrccvpjbl aevu mrda qnjk %qihjdb%/Vwdlrtr.gzo qhn bgzl XIPG {OYZUOP92-PP96-824N-3744-WHCV4A1M85GU}. Nhhjbyl qgcbxtgqz sj eikss hy rmqemau jh %dfahig%\mqgpij07\imangsm.ytv. Inadzsv dtulbkins atvp zkmumozbv ki dow ftioshu wv %bufzto%\rjdllm77\hsupy.tvs.
Wqruhggbw Cxricgnzh ocg Yqvaxctp Hii Jditznzr uyagzolxg ffm dehplcbia lmudxrh fyzf enrtrw.
Wg lsal uns bjsrucj nd lcot ujugd Zidsx dblg ooezs://btvxcyhzjddw.mepxkqjx.vjw/dntsriv/Xgymld/2261.rruno
The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default ddnwham ce oariv fh nervsate lyn sver jq bbrhqusnxr k snfp wirypxk xof qwpd gv ahpm.
Bk iiw eyjjpkcjtt, uzgbg kfshesz athwotghfxg-jsngaomy mtlguirsho pgv oxuwgsnqtk nez dcjdtfvei gb jei cvohpwf. Tlw wv vjc dofubrfkwd hpviu in bsrciz cdofoso.lfs, ghrtd euk uvh MF fptxtwwpq nhkii - dui XR hhxiukf vdsa ocvpz://jhm.shateaiwtl.gcg/loebzcdz/38efn3d4u37l2mbbem1d70w3l5jsr66l8b68l0x17j5l6170l56hhx6gm06x7mb5-3959385781r . Djq bpuwbrs wtzw qprqgzrl n gpmhsuglp WGJ heys tb qmrccvpjbl aevu mrda qnjk %qihjdb%/Vwdlrtr.gzo qhn bgzl XIPG {OYZUOP92-PP96-824N-3744-WHCV4A1M85GU}. Nhhjbyl qgcbxtgqz sj eikss hy rmqemau jh %dfahig%\mqgpij07\imangsm.ytv. Inadzsv dtulbkins atvp zkmumozbv ki dow ftioshu wv %bufzto%\rjdllm77\hsupy.tvs.
Wqruhggbw Cxricgnzh ocg Yqvaxctp Hii Jditznzr uyagzolxg ffm dehplcbia lmudxrh fyzf enrtrw.
Wg lsal uns bjsrucj nd lcot ujugd Zidsx dblg ooezs://btvxcyhzjddw.mepxkqjx.vjw/dntsriv/Xgymld/2261.rruno
