差出人
Microsoft <info@micromaxinfo.com>
件名
親愛なるMicrosoftユーザー、
返信先
Microsoft <info@micromaxinfo.com>
内容
親愛なるMicrosoftユーザー、

私たちの受賞者の一人として、新興のためのおめでとうは、詳細については添付文書を表示。

Owen Sagness
取締役社長、
マイクロソフト英国、副社長、マイクロソフトインターナショナル
®CORPORATIONS

☓☓プロモーション.rtf
☓☓プロモーション.pdf

wordの内容を開くと感染するかもしくはサイトへ飛ぶようになっている。
wordには、実行コマンドが入っているのソースでがわかる。
気をつけましょう

時差　UTC+5:30
間違いなく　インド
経由場所
IP Address 43.252.91.82
Host Name mail.micromaxinfo.co
m
Country India
Network(ASN) E2E-NETWORKS-IN
IP Prefix 43.252.88.0 – 43.252.91.255
Description E2E Networks Route

IP Address 199.19.105.109
Host Name mta9.ragoonmoon.info
Country United States
Network(ASN) ARIN-CIDR-BLOCK
IP Prefix 199.0.0.0 – 199.255.255.255
Description Not allocated by APNIC

ソース
From – Mon Nov 23 08:21:46 2015
X-Account-Key: account2
X-UIDL: 0001258b46de9b9e
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <info@micromaxinfo.com>
X-Original-To:
Delivered-To:
Received: from mail.micromaxinfo.com (mail.micromaxinfo.com [43.252.91.82])
by (Postfix) with ESMTP id 1CC6D34CA19B
for <>; Mon, 23 Nov 2015 07:41:20 +0900 (JST)
Received: from localhost (localhost [127.0.0.1])
by mail.micromaxinfo.com (Postfix) with ESMTP id 6C2C92A04A7;
Mon, 23 Nov 2015 02:15:36 +0530 (IST)
X-Virus-Scanned: amavisd-new at mail.micromaxinfo.com
Received: from mail.micromaxinfo.com ([127.0.0.1])
by localhost (mail.micromaxinfo.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id R2HZ23xvJiR3; Mon, 23 Nov 2015 02:15:35 +0530 (IST)
Received: from localhost (localhost [127.0.0.1])
by mail.micromaxinfo.com (Postfix) with ESMTP id 872F52A04ED;
Mon, 23 Nov 2015 02:15:28 +0530 (IST)
X-Virus-Scanned: amavisd-new at mail.micromaxinfo.com
Received: from mail.micromaxinfo.com ([127.0.0.1])
by localhost (mail.micromaxinfo.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id VfRX4Qgrmnwa; Mon, 23 Nov 2015 02:15:27 +0530 (IST)
Received: from mail.micromaxinfo.com (zimbra.micromaxinfo.com [43.252.91.82])
by mail.micromaxinfo.com (Postfix) with ESMTP id 501A42A0390;
Mon, 23 Nov 2015 02:15:22 +0530 (IST)
Date: Mon, 23 Nov 2015 02:15:21 +0530 (IST)
From: Microsoft <info@micromaxinfo.com>
Reply-To: Microsoft <microsoftpromo@yeah.net>
Message-ID: <1951012837.655833.1448225120947.JavaMail.root@micromaxinfo.com>
In-Reply-To: <1900888397.653317.1448223881290.JavaMail.root@micromaxinfo.com>
References: <1900888397.653317.1448223881290.JavaMail.root@micromaxinfo.com>
Subject: =?utf-8?Q?_=E8=A6=AA=E6=84=9B=E3=81=AA=E3=82=8BMicr?=
=?utf-8?Q?osoft=E3=83=A6=E3=83=BC=E3=82=B6=E3=83=BC=E3=80=81?=
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=”—-=_Part_655830_1617268525.1448225120903″
X-Originating-IP: [199.19.105.109]
X-Mailer: Zimbra 8.0.2_GA_5569 (zclient/8.0.2_GA_5569)
Thread-Topic: =?utf-8?B?6Kaq5oSb44Gq44KLTWljcm9zb2Z044Om44O844K244O844CB?=
Thread-Index: rG8RTCzkOgh4wO8+T/VvNwre7xnVL+Eqx4n5
To: undisclosed-recipients:;

——=_Part_655830_1617268525.1448225120903
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64

6Kaq5oSb44Gq44KLTWljcm9zb2Z044Om44O844K244O844CBCgrnp4HjgZ/jgaHjga7lj5fos57o
gIXjga7kuIDkurrjgajjgZfjgabjgIHmlrDoiIjjga7jgZ/jgoHjga7jgYrjgoHjgafjgajjgYbj
ga/jgIHoqbPntLDjgavjgaTjgYTjgabjga/mt7vku5jmlofmm7jjgpLooajnpLrjgIIKCk93ZW4g
U2FnbmVzcwrlj5bnt6DlvbnnpL7plbfjgIEK44Oe44Kk44Kv44Ot44K944OV44OI6Iux5Zu944CB
5Ymv56S+6ZW344CB44Oe44Kk44Kv44Ot44K944OV44OI44Kk44Oz44K/44O844OK44K344On44OK
44OrCsKuQ09SUE9SQVRJT05TCg==
——=_Part_655830_1617268525.1448225120903
Content-Type: application/rtf;
name=”=?utf-8?B?TWljcm9zb2Z0IFdpbmRvd3Pjg5fjg63jg6Ljg7zjgrfjg6fjg7MucnRm?=”
Content-Disposition: attachment;
filename=”=?utf-8?B?TWljcm9zb2Z0IFdpbmRvd3Pjg5fjg63jg6Ljg7zjgrfjg6fjg7MucnRm?=”
Content-Transfer-Encoding: base64

ソース
From – Mon Nov 23 2015
X-Account-Key: account2
X-UIDL: 000125
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <info@micromaxinfo.com>
X-Original-To: ○○@○○
Delivered-To: ○○@○○
Received: from mail.micromaxinfo.com (mail.micromaxinfo.com [43.252.91.82])
by mail.○○ (Postfix) with ESMTP id 1　B
for <○○@○○>; Mon, 23 Nov 2015 0　0 +0900 (JST)
Received: from localhost (localhost [127.0.0.1])
by mail.micromaxinfo.com (Postfix) with ESMTP id 6C04A7;
Mon, 23 Nov 2015 02:15:36 +0530 (IST)
X-Virus-Scanned: amavisd-new at mail.micromaxinfo.com
Received: from mail.micromaxinfo.com ([127.0.0.1])
by localhost (mail.micromaxinfo.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id R2HZ23xvJiR3; Mon, 23 Nov 2015 02:15:35 +0530 (IST)
Received: from localhost (localhost [127.0.0.1])
by mail.micromaxinfo.com (Postfix) with ESMTP id 872FED;
Mon, 23 Nov 2015 02:15:28 +0530 (IST)
X-Virus-Scanned: amavisd-new at mail.micromaxinfo.com
Received: from mail.micromaxinfo.com ([127.0.0.1])
by localhost (mail.micromaxinfo.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id VfRX4Qgrmnwa; Mon, 23 Nov 2015 02:15:27 +0530 (IST)
Received: from mail.micromaxinfo.com (zimbra.micromaxinfo.com [43.252.91.82])
by mail.micromaxinfo.com (Postfix) with ESMTP id 5010390;
Mon, 23 Nov 2015 02::22 +0530 (IST)
Date: Mon, 23 Nov 2015 02::21 +0530 (IST)
From: Microsoft <info@micromaxinfo.com>
Reply-To: Microsoft <microsoftpromo@yeah.net>
Message-ID: <1951012837.655833.1448225120947.JavaMail.root@micromaxinfo.com>
In-Reply-To: <1900888397.653317.1448223881290.JavaMail.root@micromaxinfo.com>
References: <1900888397.653317.1448223881290.JavaMail.root@micromaxinfo.com>
Subject: =?utf-8?Q?_=E8=A6=AA=E6=84=9B=E3=81=AA=E3=82=8BMicr?=
=?utf-8?Q?osoft=E3=83=A6=E3=83=BC=E3=82=B6=E3=83=BC=E3=80=81?=
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=”—-=_Part_655830_1617268525.1448225120903″
X-Originating-IP: [199.19.105.109]
X-Mailer: Zimbra 8.0.2_GA_5569 (zclient/8.0.2_GA_5569)
Thread-Topic: =?utf-8?B?6Kaq5oSb44Gq44KLTWljcm9zb2Z044Om44O844K244O844CB?=
Thread-Index: rG8RTCzkOgh4wO8+T/VvNwre7xnVL+Eqx4n5
To: undisclosed-recipients:;

——=_Part_655830_1617268525.1448225120903
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64

6Kaq5oSb44Gq44KLTWljcm9zb2Z044Om44O844K244O844CBCgrnp4HjgZ/jgaHjga7lj5fos57o
gIXjga7kuIDkurrjgajjgZfjgabjgIHmlrDoiIjjga7jgZ/jgoHjga7jgYrjgoHjgafjgajjgYbj
ga/jgIHoqbPntLDjgavjgaTjgYTjgabjga/mt7vku5jmlofmm7jjgpLooajnpLrjgIIKCk93ZW4g
U2FnbmVzcwrlj5bnt6DlvbnnpL7plbfjgIEK44Oe44Kk44Kv44Ot44K944OV44OI6Iux5Zu944CB
5Ymv56S+6ZW344CB44Oe44Kk44Kv44Ot44K944OV44OI44Kk44Oz44K/44O844OK44K344On44OK
44OrCsKuQ09SUE9SQVRJT05TCg==
——=_Part_655830_1617268525.1448225120903
Content-Type: application/rtf;
name=”=?utf-8?B?TWljcm9zb2Z0IFdpbmRvd3Pjg5fjg63jg6Ljg7zjgrfjg6fjg7MucnRm?=”
Content-Disposition: attachment;
filename=”=?utf-8?B?TWljcm9zb2Z0IFdpbmRvd3Pjg5fjg63jg6Ljg7zjgrfjg6fjg7MucnRm?=”
Content-Transfer-Encoding: base64