開いたらウイルス感染メール実例60と無料対策添付ファイルvbs拡張子が危険

初回投稿 2016年10月26日
最終更新 2017年12月28日

開いたらウイルス感染メール実例60と無料対策 添付ファイルvbs拡張子が危険

Image いらすとや

次のようなもっともらしい名目で、添付ファイルを確認するよう誘導する英語表記の怪しい 迷惑メール（スパムメール） が不特定多数にバラ撒かれてます。

金銭の支払い請求書/インボイス
荷物の配達通知
コピー複合機やFAXのデータ受信
など

添付ファイルのあるウイルスメール実例

Credit Card Details ＝クレジットカードの詳細
Dear [メールアドレスの一部],
I send you the details (inc. last transactions) of your VISA card #[数字], as you requested.
If you need more information, feel free to contact me

Transactions ＝取引
Hi [メールアドレスの一部],
[人名] called me yesterday updating about the transactions on company's account from last month.
Examine the attached transaction record. Please let me know if you need more help

Flight tickets ＝航空券
Dear [メールアドレスの一部],
Thank you very much for your purchase #[数字].
We have received your payment for the flight tickets. The tickets information is attached

Bill ＝請求書
Dear [メールアドレスの一部]
To continue using our maintenance service, please pay for last month's fee by 4th of November.
The bill is attached in the email

Order [数字] (Acknowledgement) ＝注文 [数字] (受領書)
Please find document attached

Parcel no. [数字] ＝小包番号 [数字]
Dear [メールアドレスの一部]. Your Parcel no. [数字] is shipped out on 03/11/2016 and estimated to arrive on 05/11/2016.
Please see the attached parcel details for more information

Please verify = 確認してください
Hey [メールアドレスの一部], as you requested, I have proofread the technical document you sent.
There are some confused parts in it.
Please verify the parts highlighted in the attached document

Your shipment ＝発送
Your shipment arrives to our warehouse today.
See the attachment for the item price and shipping fee

Financial documents ＝財務文書
Hi [メールアドレスの一部]
These financial documents need to be uploaded on the system.
Please let me know if you experience any technical problems

Photo from office

DSCF[数字].png / DSCF[数字].pdf / DSCF[数字].tiff / DSCF[数字].jpg / DSCF[数字].gif

A/C [数字] - Overdue Invoice
Good Morning,
Please see attached invoice
The balance of ¢[数字].[数字] is overdue for payment, please can you confirm a payment date?

[Scan] 2016-1129 [数字]:[数字]:[数字]
Sent with Genius Scan for iOS

Message from KMBT_C220
送信者 scanner＠[ドメイン名]

E-Mailed Invoices Invoice_[英数字]
Please find attached your latest purchase invoice.
Any queries with either the quantity or price MUST be notified immediately to the department below.
Yours sincerely, Sales Ledger Department
Tel: +44 (0) [数字] [数字] [数字]

scanned copy

Emailing: PIC[数字].JPEG / Emailing: PIC[数字].GIF / Emailing: PIC[数字].TIFF / Emailing: PIC[数字].PNG / Emailing: Scan[数字]
The message is ready to be sent with the following file or link attachments:
｛PIC[数字].JPEG｛PIC[数字].GIF｛PIC[数字].TIFF｛PIC[数字].PNG｛Scan[数字]
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled

[数字]_Invoice_[数字]
Sent from my iPhone

(件名なし)
Your Payment is attached

Voice Message Attached from [数字] - name unavailable
｛Time: Fri, 28 Jul 2017 [数字]:[数字]:[数字] +[数字]
｛Time: Thu, 17 Aug 2017 [数字]:[数字]:[数字] +[数字]
Click attachment to listen to Voice Message

Receipt-[数字] / Payment Receipt-[数字] / Payment [数字]
Attached is the copy of your payment receipt

Scan Data
Number of pages: [数字]
Attachment File Type: PDF

Voicemail From 845-551-[数字] at 9:35AM
Voice Message received at 9:35AM Voicemail Length 19sec

Invoice NIC[数字]
If you cannot view this attachment download a copy of Adobe Acrobat Reader from: http：//get.adobe.com/reader/
Email powered by Reform
PLEASE CONSIDER THE ENVIRONMENT BEFORE PRINTING THIS EMAIL

E 2017-08-09 ([数字]).doc / E 2017-08-09 ([数字]).xlsx / E 2017-08-09 ([数字]).pdf
Files attached. Thanks

JPEG_[数字] / JPG_[数字] / IMG_[数字] / PIC_[数字] / SCAN_[数字]

Scanned Image from a Xerox WorkCentre
You have a received a new image from Xerox WorkCentre.
Sent by:
Number of Images: [数字]
Attachment File Type: PDF
WorkCentre Pro Location: Machine location not set
Device Name:
Attached file is scanned image in PDF format.

Voice Message Attached from [数字] – name unavailable
Time: Wed, 23 Aug 2017 [数字]:[数字]:[数字] +[数字]
Download file to listen Voice Message

Copy of Invoice [数字]
Please download file containing your order information.
If you have any further questions regarding your invoice, please call Customer Service.
Please do not reply directly to this automatically generated e-mail message.
Thank you.
Customer Service Department

Your Sage subscription invoice is ready
Dear Customer
Your Sage subscription invoice is now ready to view.
Sage subscriptions
To view your Sage subscription invoice click here
Got a question about your invoice?
Call us on 0845 111 6604

New voice message [数字] in mailbox [数字] from "[数字]" <[数字]>
Dear user:
just wanted to let you know you were just left a 0:[数字] long message (number [数字]) in mailbox [数字] from "[数字]" <[数字]>, on Fri, 25 Aug 2017 [数字]:[数字]:[数字] +[数字]
so you might want to check it when you get a chance. Thanks!
Voicemail Service

photos / photo / documents / images / please print / pictures / scans
Download it here
*[人名]*

Overdue BT bill
Hi
I’ve had this BT reminder in the post today

You have received a scan from AT Management
Hi,
Please find attached a scan to print

Message from «G10PR0151001.[ドメイン]»
Sent: Tue, 29 Aug 2017 [数字]:[数字]:[数字] +[数字]
To: [人名], [人名]
Subject: Message from «G10PR0151001.[ドメイン]»
This E-mail was sent from «G10PR0151001.[ドメイン]» (Aficio MP C305).
Scan Date: Tue, 29 Aug 2017 [数字]:[数字]:[数字] +[数字]

E-invoice for your order #[数字]
Dear Customer, Thank you for shopping with Apple Pty Ltd
Please find enclosed your official Apple Tax Invoice.
Please retain a copy of this invoice for your records. Your Apple invoice may also be required to obtain warranty services.

Emailed Invoice - [数字]:1
As requested
regards

August Payment ＝ 8月の支払い
Good morning
Please find the attached.
The amount of £[数字].[数字] should be received today via BACS

Invoice INV-[数字] from Property Lagoon Limited for Gleneagles Equestrian Centre / Invoice INV-[数字] from Verizon
Dear customer,
Here’s invoice INV-[数字] for USD [数字].[数字].
The amount outstanding of USD [数字].[数字] is due on 9 Sept 2017.
View your bill online
From your online bill you can print a PDF, export a CSV, or create a free login and view your outstanding bills

[数字] - True Telecom Invoice for August 2017
Dear Deborah Day
We have attached your latest True Telecom bill for August 2017.
View your bill online
To be able to read your invoice file you will require the Adobe Acrobat PDF viewer. You August already have this installed,
if not please visit the Adobe website and download their free viewer

Scanning
https：//dropbox.com/file/[英数字]
https：//dl.dropbox.com/u/[数字]/[数字]
Taylored Group
26 City Business Centre
Hyde Street
Winchester
SO23 7TA
Members of the CAERUS Capital Group

Microsoft Store E-invoice for your order #[数字]
Dear Customer,
Thank you for shopping with Microsoft Store
Please find enclosed or download your official Microsoft Store Invoice.
Please retain a copy of this invoice for your records. Your Microsoft
invoice may also be required to obtain warranty services.
Thank you
Microsoft Store 2017

Status of invoice / Status of invoice A[数字]-[数字]
Hello,
Could you please let me know the status of the attached invoice? I appreciate your help!
Best regards,
Tel: 206-575-8068 x 100
Fax: 206-575-8094
*NEW*

Message from KM_C224e

HERBALIFE Order Number: [英数字] ＝ハーバライフ注文番号
Thank you for your order.
Please find attached your tax invoice for [英数字] .
Your order is now being processed

Emailing - [数字]
This email, and any attachments, is strictly confidential and may be legally privileged. It is intended only for the addressee. If you have received this message in error, please contact the sender. Any request for disclosure of this document under the Data Protection Act 1998 or Freedom of Information Act 2000 should be referred to the sender. [disclaimer id: HCCStdDisclaimerExt]

Your Payment # [数字]
Your Payment is attached.

Invoice RE-2017-09-21-[数字]
Dear customer,
We want to use this opportunity to first say "Thank you very much for your purchase!"
Attached to this email you will find your invoice.
Kindest of regards,
your Amazon Marketplace

Your Invoice # [数字]
Your Invoice is attached.
If you feel you have received this email in error, please reply to this email to inform us of any necessary corrections

Message from [数字]
｛25/09/2017, [数字]:[数字]:[数字] PM
｛05/10/2017, [数字]:[数字]:[数字] PM
｛18/10/2017, [数字]:[数字]:[数字] PM
｛[数字],[数字]-second message deposited by [数字]
｛[数字],{rndnum(1,1)}}-second message deposited by [数字]

INVOICE
Dear Sir,
PLEAS FIND ATTACHED YOUR INVOICE AS REQUESTED.
Thank you and Kind regard’s
For Techno-Packaging

Invoice PIS[数字]
Please find Invoice PIS[数字] attached

Invoice
Hi
Invoice attached for the Office365 account
Virus-free. www.avast[.]com

Copy of invoice A[数字]. Please find your invoice attached.
Dear customer
Thank you for shopping with Electricfix. A copy of your invoice is attached. If your invoice is not attached please email invoice.
Order number: A[数字]

Invoice
[人名]
Director
[数字]
[メールアドレス]

Invoice INV[数字]
Sent from my iPhone

Your Remittance Advice
Please find attached.
Kind regards
Accounts Dept
SAVE PAPER - THINK BEFORE YOU PRINT!
This E-mail is confidential

Invoice IP[数字]
Please find Invoice IP[数字] attached

Document invoice_[数字]_sign_and_return.pdf is complete
Hello,
This document has been signed and is now complete.
Filename: invoice_[数字]_sign_and_return.pdf
Reference #: [英数字]
Subject: Please sign
Message: Please sign this document.
For your convenience, a pdf of the completed document is attached to this email.
Thank you for using RightSignature!

Voicemail From 845-551-[数字]
Voice Message received at Tue, 10 Oct 2017 11:01:10 -0500
Voicemail Length 24 sec

Supplement payment [数字]
This E-mail is confidential
Internet communications cannot be guaranteed to be timely secure, error or virus-free. The sender does not accept liability for any errors or ommisions

Invoice [数字] 10.18.2017

Scanned from Epson / Scanned from Canon / Scanned from Lexmark / Scanned from HP

CC Confirmation
Hi:
Attached is confirmation of your credit card payment per your requested.
Please advise if you should have any questions & I would be happy to help

Message From "[数字]" [数字]
｛Created: Tue, 19 Dec 2017 [数字]:[数字]:[数字] -[数字]
｛Created: Wed, 20 Dec 2017 [数字]:[数字]:[数字] +[数字]
Duration: [数字]m [数字]s
Account: [メールアドレス]

Voice Message from Outside Caller ([数字]m [数字]s)
Voice Message Arrived on Tue, 19 Dec 2017 [数字]:[数字]:[数字] -[数字]
Name: Outside Caller
Number: Unavailable
Duration: [数字]m [数字]s

Scan
Thanks & Regards
[人名]

CCE[数字]_[数字]

メールの内容にサッパリ見に覚えがなく、英語の意味すら分からない…。

…にも関わらず、メールを手元に受け取ると、自分で ”怪しい” と判断できず右往左往するユーザーさんが日本国内に一定数いるのが実情です。

添付ファイルはスクリプトファイル .vbs

添付ファイルは圧縮アーカイブ（.zip / .rar / .7z）です。

これを展開・解凍して中身を確認すると、VBScript Script ファイル（拡張子 .vbs）というファイル形式が登場しました。

不正なスクリプトファイル .vbs 実例

【迷惑メールの添付ファイル例】
fixed_invoice_[英数字].zip / budget_xls_[英数字].zip / order_details_[英数字].zip
　↓ ユーザーが解凍・展開する

fixed invoice [英数字].vbs /budget [英数字] xls.vbs / order details [英数字].vbs

こんなファイルをメールでやり取りすることは100％あり得えません。

しかし、そのアイコン画像が白紙の上に水色の巻物が描かれてる図案なので、ファイルの種類に無知なユーザーさんは ”文書” と勘違いするトラップになってます。

Windows パソコン上で .vbsファイルを何気なくポチポチッと ダブルクリック して開くのは、怪しい実行ファイル（拡張子 .exe）を開くことと完全に同一であり危険です。

ちなみに、vbs ファイルは Mac OS X、Android スマホ、iOS（iPhone/iPad）、ガラケーといった環境は、動作対象外なので影響はなく大丈夫です。

ウイルス感染被害！無料ウイルス対策は？

動作確認のため、手元で .vbsファイルを故意に開いてみました。

すると、外部ネットワークからランサムウェア（身代金型ウイルス）の1つで知られる Locky がダウンロードされてきてシレッと起動しました。

迷惑メールの添付ファイルを開いたら…

【感染画像の説明】
1. 圧縮アーカイブが添付された迷惑メールを受信
2. 添付ファイルを展開・解凍すると中からVBScriptファイル .vbs が登場
3. ダブルクリックで開くと wscript.exe を介して外部ネットワークと通信
4. ダウンロードされてきたランサムウェアがシレッと起動して感染

これにより、PC 内にある文書や画像（写真）といったファイルがドンドン破壊されていき、最終的に身代金を支払うよう要求される被害です。