Search
Keyword: HTML_SOHANAD
message content itself is its use of a spam technique called HTML inserts - it abuses HMTL tags to insert random words that when grouped together have no meaning. Clicking on the link leads to the download
<SPAN style="FONT-FAMILY: 'Times New Roman','serif'; FONT
view a PDF copy of his/her personal invoice. Under the guise of the links are ransomware-related URLs that can infect machines. Some variants of this spam also come with malicious HTML attachments.
This malicious URL hosts the malware TROJ_DLOAD.VAC.
When accessed, this malicious URL downloads a file that is detected as TROJ_SMALL.NSZ.
HTML_REDIR.MC redirects users to this site.
JS_REDIRECTOR.FX redirects users to this URL.