[Dshield] A new Netsky variant ?

[Andreas Maus]

Hi list.

As I can see the attachment was stripped by the list
server. If you are interested in this sample yo can
fetch it from:

http://ypbind.de/maus/dshield/your_document.zip

This file contains the attachment (your_document.doc.pif)
and the complete email that contains the file.

Obviously the password for the ZIP archive is "infected" ;)

Andreas.

-- 
"Things that try to look like things often do
 look more like things than things. Well-known fact."
Granny Weatherwax - "Wyrd sisters"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.sans.org/pipermail/list/attachments/20070511/bfe49491/attachment.bin