A quick look at a signed spam campaign
A quick look at a signed spam campaign I noticed the following tweet pass by on Twitter: Just received my 1st-ever digitally signed piece of spam. The ribbon is bound to entice someone 2 click on the email pic.twitter.com/470TpdaPDE � Robert (??????) (@RobertIdAu) November 9, 2015 The mail received is as follows: Spam but digitally signed As Robert correctly notes, since the mail is digitally signed, it may entice people more to open the attachment and get infected. In case youre wondering, the key id of the certificate is as follows: FE:22:B7:24:E3:4F:27:D9:05:E0:CC:B8:BD:DE:F4:8D:23:FD:2F:D9 (copy of cert on Pastebin) Issuer: C=IT, O=DigitPA, OU=Ufficio interoperabilita e cooperazione, CN=DigitPA CA1 Signature details. S/MIME message format Both first and second mail are coming from: 175.156.221.127 - IPvoid - Whois (DomainTools) IP location: Singapore (VirusTotal) On to the attachment (the .xml file is harmless): "recalculation.zip" attached Hello This recalculation of p...