Amazon_Invoice_viewer.zip is a trojan

MX Lab intercepted some emails with the attachment Amazon_Invoice_viewer.zip that contains the trojan W32/Trojan3.BWX (Authentium), Mal/EncPk-RB (Sophos), Trojan.FakeAV (Symantec).

The email comes from random spoofed email addresses and can contain different subjects like:

As long as it stays unsaid
Mindblowing sales
Exclusive prices
What’s your hobby
Top 5 sales today
Confirm your sample
….

The body of the email also changes so here are some examples:

Your confirmation reqired

Please find attached invoice.

Boost your Dignity

Please find attached invoice.

Add more mass to your manliness

Please find attached invoice.

Your lovegun final destination

Please find attached invoice.

Attached to the email is the file Amazon_Invoice_viewer.zip that contains the 20 kB large file Amazon_Invoice_viewer.exe inside.

Virus Total permlink and MD5: a46dbd99349e1528805d8192777a01ea