初回投稿 2016年7月13日
最終更新 2017年7月26日

開いたらウイルス感染メール実例90と無料対策 添付ファイルwsf拡張子が危険

イメージ 5

前から 添付ファイルを確認するよう誘導してウイルス感染させる 迷惑メール(スパムメール) が不特定多数のユーザーにドバッと配信されてます。 <英語表記のメール実例
Letter / Scan / Re: / Attahed
Please find the reference letter I attached
King regards
Word Document / Fw: Fw: / Re: / Document
{Please find attached the minutes of the Project Progress Review Meeting, for your reference, action & records
{Please find the attached file (scanned invoice)
{Please find the necessary documents attached
{Please find the relevant documents attached
Best regards
Please review / Fw: / Info / Re: / Important / Need your attention
Hi [メールアドレスの一部],
{Thank you for your letter of 12 July
{I am very grateful to you for responding to my email so quickly
{It was an honour to meet you yesterday
{I have attached the company report. Please review and let me know about any changes that are required
{The spreadsheet you requested is attached
{Please find the schedule attached
Important / Please review / ATTN / Need your attention / Fw: / Hi / Document
{I am attaching the timesheets of our section employees for July 2016
{I have attached payment topic which I would like to discuss with staff
{Please fine attached the updated worksheet, thanks!
{Please find attached the copy of remittance for your information
{Please find the financial calendar for August attached
{Please, find attached my CV
{If there is anything else, please let me know
{Should you need further information, please do not hesitate to call on me
{Should you require any further information, please do not hesitate to contact me
{Thank you for giving me your kind attention
{Thank you for your kind co-operation
scanned / RE: / document / attached
{How are things?
{How is it going?
Please find attached document you asked for and the latest payments report
Hope that helps. Drop me a line if there is anything else you want to know
scanned / attached / FW: / RE:
{How are things?
{How is it going?
Please find attached invoice you asked for.
Hope that helps. I’m waiting impatiently for your reply
bank account report = 銀行口座の報告書
{Dear [メールアドレスの一部]
{Hello
{Hi [メールアドレスの一部]
{How are things?
{How is it going?
Thank you very much for responding my email in a very short time. Attached is the bank account report. Please look at it again and see if you have any disapproval
company database = 会社のデータベース
{Dear[メールアドレスの一部]
{Hello
{Hi [メールアドレスの一部]
{How are things?
{How is it going?
I am deeply gratified that you reacted to my email promptly.
The attached is concerned with the company database. Feel free to comment me on the subject
Business Analysis = 経営分析
I attached the detailed business analysis (updated}
new invoice = 新しい請求書
please check the attached invoice
fixed invoice = 修正された請求書
I am very sorry for the wrong data file you received from me yesterday.
Attached is the fixed invoice
件名 sales report = 売上報告書
I am truly sorry that I was not available at the time you called me yesterday.
I attached the report with details on sales figures.

Re[3]: / Re[4]: / Re[7]:
Deep apology for my late reply
Upon your request, Company credit account is attached to this email
list of activities = 活動の一覧
Hello,
Attached is the list of activities to help you arrange for the coming presentation. Please read it carefully and write to me if you have any concern
upcoming meeting = 次回の会議
Dear [メールアドレスの一部],
The details of the upcoming meeting and agendas are attached
updated details = 更新された詳細
Dear [メールアドレスの一部],
Attached is the updated details about the company account you needed
annual report = 年次報告書
Hi [メールアドレスの一部],
Speaking of the event, I attached the annual report that we discussed about
Invoice
Hello,
Please check the attached invoice and confirm me if I sent the right data
Foundation plan = 基礎計画
Hello,
I attached the foundation plan I made for our campaign
Bank account record = 銀行口座の記録
Good morning,
Did you forget to finish the Bank account record?
Read the attachment and let me know if there is anything I didn't make clear
Voicemail from Anonymous <Anonymous> [数字]:[数字]:[数字]
送信者 SureVoIP <voicemailandfax@surevoip.co.uk>

Message From "Anonymous" Anonymous

Message from “RNP002673868AAB” / FW: Message from «RNP002673868AAB»
There you go mate.
Marek Baranovic
Client Accountant

Corrected report = 修正された報告書
Dear [メールアドレスの一部],
Please review the attached corrected annual report
Sales charts = 売上チャート
Dear[メールアドレスの一部],
See the attached charts about last month’s sales growth
Documents Requested / :Documents Requested / Re:Documents Requested / FW:Documents Requested
Dear [メールアドレスの一部],
Please find attached documents as requested.
Best Regards
New Doc [数字]_[数字].pdf
Scanned by CamScanner
Sent from Yahoo Mail on Android
Message from «CUKPR[数字]» / Message from “CUKPR[数字]”
送信者 <
scanner@[メールアドレスの一部]>
This E-mail was sent from “CUKPR[数字]” (Aficio MP C305).
{Scan Date: 17.11.2015 09:08:40 (+0000)
{Scan Date: Tue, 06 Sep 2016 [数字]:[数字]:[数字] +[数字]
{Scan Date: Wed, 28 Sep 2016 [数字]:[数字]:[数字] +[数字]
Queries to:
Blank 2
Copy: Receipt([数字]) / Copy: Document([数字])
Emailing: Label
Good afternoon
The office printer is having problems so I’ve had to email the UPS label, sorry for the inconvenience

[Vigor2820 Series] New voice mail message from [数字] on [日付] [時刻]
送信者 <voicemail@[メールアドレスの一部]>

Dear [メールアドレスの一部] :
There is a message for you from [数字], on [日付] [時刻] . You might want to check it when you get a chance.Thanks!
Voice Message from Outside Caller ([数字]m [数字]s)
送信者 Peach Telecom

Voice Message Arrived on Friday, Aug 26 @ [数字]:[数字] AM
Name: Outside Caller
Number: Unavailable
Duration: [数字]m [数字]s
Please find attached invoice no: [数字]
差出人 <document@[メールアドレスの一部]>
Attached is a Print Manager form.
Format = Portable Document Format File (PDF)
Disclaimer
mortgage documents = 抵当の文書
Dear [メールアドレスの一部], I am attaching the mortgage documents relating to your department.
They need to be signed in urgent manner
Transaction details = 取引の詳細
Hi [メールアドレスの一部], The transaction you requested was not able to proceed. Please see the attachment to recheck the account number
Image / Picture / Photo / Photos / Document / Fax / my photo / FAX_[数字] / IMG_[数字] / SCAN_[数字] / DOC_[数字]
[数字]docx / [数字]pdf / [数字]jpg / [数字]png / [数字]gif / [数字]tiff / [数字]d.ocx / [数字].pdf / [数字].jpg / [数字].png / [数字].gif / [数字].tiff
送信者 <[人名]_[数字]@icloud.com>
Invoice INV[数字]
Please find our invoice attached
Confirmation letter = 確認のお知らせ
Dear customer,
The bank has sent loan confirmation letter. Please review the amount of funds.

件名 Tax invoice = 税金の請求書
Dear Client,
Attached is the tax invoice of your company. Please do the payment in an urgent manner
payment copy
Best Regards
Account report = アカウント通知
Dear [メールアドレスの一部], we have detected the cash over and short in your account.
Please see the attached copy of the report
Renewed License = ライセンスの更新
Here is the company's renewed business license.
Please see the attached license and send it to the head office
SCAN
[人名]
Logistics Department
ALGRAFIKA SH.P.K
Tel : +355 4 23 52 [数字]
Fax: +355 4 23 73 [数字]
Emailing: _[数字]_[数字] / Emailing: [数字] / Emailing: [数字].gif / Emailing: [数字].png / Emailing: [数字].tiff / Emailing: [数字].jpg
Your message is ready to be sent with the following file or link attachments:
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments
documents = 文書
[人名] Office Manager
Box Rentals LLC
Sanibel Executive Suites
Crestwood Apts.
Cleveland Apts.
Receipt [数字] from The Music Zoo
Thank you for your order!  Please find your final sales receipt attached to this email.
Your USPS Tracking Number is: [数字]
Photo from [人名]
送信者 <~@gmail.com>
Updated invoice #[数字]
Our sincere apology for the incorrect invoice we sent to you yesterday.
Please check the new updated invoice #[数字] attached.
We apologize for any inconvenience
[数字].pdf
Clients accounts = 顧客のアカウント
Dear [メールアドレスの一部],
I attached the clients' accounts for your next operation.
Please look through them and collect their data. I expect to hear from you soon
Payment
Dear [メールアドレスの一部],
You are receiving this email because the company has assigned you as part of the approval team.
Please review the attached proposal form and make your approval decision.
Payment
Dear [メールアドレスの一部], thanks for working with us.
We are sending the contract that we agreed on last week.
Please read through the attachment and return us the scan of the signed contract.
Neopost documents [数字]
Dear Customer,
Please find attached your latest NeoFunds Invoice/Statement.
Statement: [数字]
Your username is [数字]
Temporarily blocked = 一時的にブロックされました
Dear [メールアドレスの一部],
this is to inform you that your Debit Card is temporarily blocked as there were unknown transactions made today.
We attached the scan of transactions. Please confirm whether you made these transactions.
Transaction details = 取引の詳細
Dear [メールアドレスの一部],
You made a credit card payment of $[数字].[数字] to our company.
Here is the transaction details attached

Emailing - [数字].pdf/ Emailing - [数字]
Hi
[人名] has asked me to forward you the finance documents. (Please see attached)
Many Thanks
Parcel details = 小包の詳細
差出人 DHL
Dear [メールアドレスの一部],
We couldn't deliver your parcel on September 30th because we couldn't verify the given address.
Attached is the shipment label. Please print it out to take the parcel from our office.
please sign =サインしてください
Hi [メールアドレスの一部],
I have made the paperwork you asked me to prepare two days ago.
Please check the attachment. It just needs your signature.
Travel Itinerary = 旅行の日程
Dear [メールアドレスの一部]
Thank you for flying with us! We attached the Travel Itinerary for Your booking number #[英数字].
See the paid amount and flight information
Bill for papers [数字]-04-10-2016
Refund = 払い戻し
Dear [メールアドレスの一部], please submit the return form to receive the refund.
The parcel must have its original packaging. The return form is attached in this mail.
contact information = 連絡先
Please visit the client tomorrow from the contact information attached.
Make sure you get there on time
Document from [人名]
送信者 <~@gmail.com>
complaint letter = 苦情のお知らせ
Dear [メールアドレスの一部], client sent a complaint letter regarding the data file you provided.
The letter is attached. Please review his concerns carefully and reply him as soon as possible.
E-TICKET [数字]
Dear Sir ,
Please find the attached E-ticket as per your requested
Voicemail from [人名] [数字] <[数字]> 00:[数字]:[数字]
送信者 SureVoIP <voicemailandfax@[ドメイン名]>

Message From "[人名] [数字]" [数字]
Created: 2016.10.31 [数字]:[数字]:[数字] PM
Duration: 00:[数字]:[数字]
Account: voicemailandfax@[ドメイン名]
Document No [数字]
Thanks for using electronic billing
Please find your document attached
Invoice No. [数字] for [メールアドレスの一部]
REF: [数字]
INVOICE NUMBER: [数字]
FROM: Vincent & Gorbing (175-187 Linthorpe Road,Buxton, Derbyshire, SK17 9QF, UNITED KINGDOM)
DATE: 01/11/2016
Your Invoice: SIPUS16-[数字]
Dear Sirs,
Please find your invoice enclosed. We kindly ask you to respect our payment terms.
For questions please contact our sales office
DSCF[数字].pdf
part [数字]
As promised
[人名]
[英字] Invoice [数字]
Please do not reply to this email. For any queries, please contact your local [英字] depot on 08457 298 298. The attached file is in PDF (Adobe Acrobat) format. To view this file you will need Acrobat Reader, available as a free download from http://www.adobe.com
New Doc [数字]_[数字].pdf
Scanned by CamScanner
Sent from Yahoo Mail on Android
INVOICE [数字] ATTACHED -Thank you for your business
[Scan] 2016-[数字] [数字]:[数字]:[数字]
Sent with Genius Scan for iOS
Statement = 報告書
For your Information

Order [数字]
Please find document attached
BP Fuel Card E-bill [数字] for Account (rnd(B,S,F,H,A,D,C,N,M,L)}}[数字] 08/11/2016 / Shell Fuel Card E-bill [数字] for Account (rnd(B,S,F,H,A,D,C,N,M,L)}}[数字] 08/11/2016
[人名]
Last & Tricker Partnership
3 Lower Brook Mews
Lower Brook Street
Ipswich Suffolk IP4 1RA
T: 01473 252961 F: 01473 233709 M: 07778464004
email: [メールアドレス]
Message from KMBT_C220
送信者 <scanner@[メールアドレスの一部]>
Abax UK Invoice [数字]
Please find attached your ABAX UK invoice.
If you have any queries or would like to arrange additional training for your staff please contact our customer service team on 01733 69 88 88
Message from "RNP[英数字]"
This E-mail was sent from "RNP[英数字]" (Aficio MP 2352).
{Scan Date: Tue, 22 Nov 2016 [数字]:[数字]:[数字] -[数字])
{Scan Date: Mon, 28 Nov 2016 [数字]:[数字]:[数字] -[数字])
Queries to: donotreply@[ドメイン名]
scan paper
Thanks & Regards,
[人名]
Insurance Authority Certificate No:222
Insurance Advisor
E [メールアドレス]
M +971 56 7185865
M +971 56 4305143
Platinum Insurance Broker LLC
Fax transmission: F-[数字]-[数字]-[数字]-[数字].zip
Please find attached to this email a facsimile transmission we have just received on your behalf
(Do not reply to this email as any reply will not be read by a real person)
Purchase Order No. [数字]
Please find attached Purchase Order No. [数字].
PLEASE DO NOT REPLY TO THIS ADDRESS.
If you have any queries in regards to your Purchase Order, please contact your requestor, [人名] on 01922 [数字] ext [数字]
Scanned image from MX2310U@[ドメイン名]
Reply to: office@[ドメイン名]
Device Name: MX2310U@[ドメイン名]
Device Model: MX-2310U
Location: Reception
File Format: PDF MMR(G4)
Resolution: 200dpi x 200dpi
Software License = ソフトウェアのライセンス
Hello [メールアドレスの一部], it is [人名].
Sending you the scan of the software license agreement (Order #[数字]).
It is in the attachment. Please look into it ASAP
Payment Confirmation = 支払い確認
Dear [メールアドレスの一部], Please confirm the recent payment (Receipt #[数字], $[数字].[数字]).
For that, open the attached document and contact us specifying the number of invoices one by one
FWD / FWD: / Your mail / RE:
Please find attached the reference letter.
{Regards,
{Sincerely yours,
[人名]
Bill for papers 13-12-2016 / Bill for papers 12-12-2016
Fixed invoices = 請求書の修正
Dear [メールアドレスの一部],
Sorry for mistakes in the invoice. The number is 362, the amount came to $289.26.
Please check out the details in the attachment
Parcel Certificate = 小包証明書
Dear [メールアドレスの一部],
Please check the parcel certificate I am sending you in the attachment.
Order number is 477-F. Quite urgent, so please review it
Accounts Documentation - Invoices
送信者 <CreditControl@[ドメイン名]>

Please find attached the invoice(s) raised on your account today. If you have more than one invoice they will all be in the single attachment above.
If you have any queries please do not hesitate to contact the Credit Controller who deals with your account.
Alternatively if you do not know the name of the Credit Controller you can contact us at:
eFax message from "03 [数字]-[数字] " - 2 page(s)
Fax Message
You have received a 2 page fax at 12/15/2016 5:01:13 PM.
* The reference number for this fax is syd1_did12-[数字]-[数字]-5.
Click here to view this fax message.
Please visit www.efax.com/en/online_fax_FAQ if you have any questions regarding this message or your service.
Thank you for using the eFax service!
Scan
Regards,
[人名]
Business Development
Mobile No.  +91 [数字]
Phone No. 021 35669 720
Lumax Industries Ltd.
608. Chakan - Talegaon Road
Mahalunge - Chakan Pune 410501 India

Photo from [人名]
{Hi
{Greetings
{Attached
{PFA
{Hello

{Enclosed
Dhl Commercial Invoices [数字] [数字] / NOTICE CUSTOMS CHARGES [数字] [数字] / commercial shipment [数字] [数字]
Attached notice amount customs charges
Dear Customer,
Attached your invoice in PDF format, dated 25/01/2017 and csv files for shipments and services provided by DHL Express.
You can also display the details of his account and the historical invoices online.
In case of substantial problems in the Annex, contact support at:
support@dhl.com
We expect to receive payment within the prescribed period, as indicated on the invoice.
We send our thanks for having taken advantage of DHL Express services.
Best regards,
DHL Express
Scanned Image from a Xerox WorkCentre
You have a received a new image from Xerox WorkCentre.
{Sent by: scanner@[メールアドレスの一部]
{Sent by: canon@[メールアドレスの一部]
Number of Images: [数字]
Attachment File Type: PDF
WorkCentre Pro Location: Machine location not set
{Device Name: scanner@[メールアドレスの一部]
{Device Name: canon@[メールアドレスの一部]
Attached file is scanned image in PDF format
Invoice PIS[数字]
Please find Invoice PIS[数字] attached

< No Subject >
Good Day,
Please see attached email bill request from May-July 2017.
Yours Sincerely,
[人名]
D354810

金銭の支払い請求書、コピー複合機のデータ受信通知、ビジネス体裁の連絡、荷物の配達発送通知、といった感じに様々なもっともらしい内容を装ってます。

古典的なウイルスメールの手口に今だに引っかかる人いるの?』 と感じるかもしれないけど、自分の元へメールが届くと見の覚えがなくても不安になって右往左往するユーザーさんがいるのが現実です。 <英語の意味が分からず思考停止したり

添付されてる圧縮アーカイブの中身は?

添付されてるのはzip形式の圧縮アーカイブなので手動で解凍・展開してみると、次のような Windows Script ファイル拡張子 .wsf) という形式でした。

イメージ 3
巻物の図案が文書に見える?

イメージ 4
決して文書ファイルではない


一般的に、文書や画像でも何でもないwsfファイルをメールでやり取りすることはありえず、ここで不自然であると気づけないとヤバいです。 <セキュリティソフトの検出をスリ抜ける恐れもあるし

不正なスクリプトファイルを開くと?

この wsfファイル をWindowsパソコン上でポチポチっと ダブルクリック して開くと、外部ネットワークからマルウェアがシレッとダウンロードされてきて感染します。

下のプロセスの様子はランサムウェアに感染した瞬間の画像です。

イメージ 2
スクリプトファイルを開いたら実行ファイルが起動!?

【VirusTotalファイルスキャン例】
www.virustotal.com/ja/file/f1566b58082edccddc797965ebb8d7a455f14dc1e7f222b102588fc4c9714802/analysis/1468409854/
なお、.wsfファイルの動作環境はWindows XP/Vista/7/8/10 パソコンだけです。

それ以外の Mac OS X、Android スマホ、iOS(iPhone/iPad)、ガラケー らへんはいっさい影響はなく大丈夫です♪

wsfスクリプトファイルのウイルス対策

よく 『怪しいメールや不審なファイルを開くな!』 と言われます。

間違ってはいないけど、その一方で人間は ヒューマエラー を引き起こすことは、過去の様々な事故で分かってます。 <精神論だけで切り抜けようというのは無謀!

イメージ 6
感染に至るプロセスでは ”人間” の行動がキモ

そこで、”怪しい” と見抜けないユーザーさんが出現するのも当然のことと考えて、それを前提にウイルスの侵入を100%確実に防ぐ 無料ウイルス対策 が有効です。

関連するブログ記事