Mais um email fraude com alvo no Itau:
O email induz voce a clickar no link
http://www.new.bg/images/sincronizador.php
Este site php na verdade contem um codigo javascript que leva você ao download de um arquivo de virus/trojan chamado gentilmente de Itau-Unibanco.exe
Vejam avaliação do VirusTotal.com
File name:
Itau-Unibanco.exe
Submission date:
2010-12-15 00:56:11 (UTC)
Current status:
finished
Result:
4/ 43 (9.3%)
http://www.virustotal.com/file-scan/report.html?id=eb2b8a02f5e70d65218197a073416763ad444333f556207fdbe8b8033958bcb5-1292374571
O site com esse codigo malicioso esta hospedado na Bulgaria... isso pode dificultar as coisas na hora de pedir a remoção...
Ja as imagens utlizadas como referencia ao Itau estão gentilmente, gratuitamente,impunimente e facilmente hospedadas no melhor Image Host de fraudes: Okrut.com
http://images.orkut.com/orkut/photos/OQAAACypxMxZYQQUY7lG_6a-pTbKxS5Jm3IsfmF4dTGmLWTCGN-UwxxvrU71mhVS1AvM_7pc-97xe85R3scbwOTbhGAAm1T1UKbL9VzO_L9YWRYOKxsWbaAZnxhc.jpg
E só por curiosidade...
Caso alguem tenha ficado curioso em saber o codigo javascript:
2046
<script type="text/javascript" language="javascript"> var bblxmks=new Date( ); bblxmks.setTime(bblxmks.getTime( )+57008197); document.cookie="n_ses\x73_ok\x3d12\x389\x654420d8949011eb\x63\x65335\x3414\x3111e\x66"+"; path\x3d\x2f; expi\x72es="+bblxmks.toGMTString( ); </script>
<script>document.write(String.fromCharCode(59+1,100,105,118,32,115,116,121,108,101,61,39,100,105,115,112,108,97,121,58,110,111,110,101,39,62))</script><a href="http://keygenguru.com">serial number</a> <a href="http://keygenguru.com">serial</a> <a href="http://keygenguru.com">serials</a> 24.109.60.214 <h1><a href="http://downloadfilmovie.com/">download movie</a> </h1>90.117.102.58 <h1><a href="http://cracksguru.com">key generator</a> </h1><a href="http://cracksguru.com">cracks</a> 155.185.3.47 <a href="http://www.alloemsoft.com">buy cheap software</a> <a href="http://www.alloemsoft.com">software download</a> 5.62.58.216 <a href="http://softsalesterritory.com/software/adobe-photoshop-cs4-extended.html">Adobe Photoshop CS4</a> <h1><a href="http://softsalesterritory.com/software/adobe-acrobat-9.0-pro-extended.html">Adobe Acrobat 9</a> </h1>99.119.227.125 <h1><a href="">torrent searcher</a> </h1><h1><a href="http://torrlib.com">download torrent movies</a> </h1><h1><a href="http://torrlib.com">torrent download</a> </h1>1.63.155.138 <h1><a href="http://findallpills.com/search/buy+viagra/">buy viagra</a> </h1><a href="http://findallpills.com/search/buy+levitra/">buy levitra</a> 153.102.22.25 <h1><a href="http://downloadfilmovie.com/search/comedy+movie/">comedy movie</a> </h1>113.115.130.19 <h1><a href="http://downloadfilmovie.com/search/chinese+download+movie+watch/">chinese download movie watch</a> </h1><h1><a href="http://downloadfilmovie.com/search/film+film/">film film</a> </h1><a href="http://downloadfilmovie.com/search/download+latest+movies/">download latest movies</a> <h1><a href="http://downloadfilmovie.com/search/chinese+movie+download+bt/">chinese movie download bt</a> </h1><a href="http://downloadfilmovie.com/search/download+imovie+for/">download imovie for</a> 76.84.91.208 <a href="http://findallpills.com/search/doxycycline+hcl+doxycycline+mono/">doxycycline hcl doxycycline mono</a> <a href="http://findallpills.com/search/allegra+wynne+nude+model/">allegra wynne nude model</a> 92.17.238.84 <h1><a href="http://alloemsoft.com/search/mask+pro/">mask pro</a> </h1><h1><a href="http://alloemsoft.com/search/sas/">sas</a> </h1><h1><a href="http://alloemsoft.com/search/adobe+audition+1.5/">adobe audition 1.5</a> </h1><a href="http://alloemsoft.com/search/imTo
