Email with Adobe license key attached contains a trojan


MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Your InDesign CS4 License key”.

The email is send from the spoofed address “Adobe <help-no.146@adobe.com>” and has the following body:

Hello,

Your Adobe CS4 License key is in attached document below.
We encourage you to explore its new and enhanced capabilities with these helpful tips, tutorials, and eSeminars.
Thank you for buying Adobe InDesign CS4 software.

Adobe Systems Incorporated

The attached ZIP file has the name License_key_N7853.zip and contains the 47 kB large file License_key.exe.

Please note that the from email address, the subject, content and name of the attached file can change accordingly.

The trojan is known as Troj/Bredo-LK (Sophos), W32/Yakes.F.gen!Eldorado (F-Prot), Downloader.Chepvil (Symantec).

At the time of writing, only 7 of the 43 AV engines did detect the trojan at Virus Total.

Virus Total permalink and MD5: 09ecaf9fd2f4d7d42b0b4fde0f53b21e.

11 thoughts on “Email with Adobe license key attached contains a trojan

  1. I just received it “from” the following address: Adobe Systems [account-no2532@adobe.com] and the following file name: License_key_N2784.zip.

  2. I received this yesterday with the “from” as helping-ids724@adobe.com

    I thought the email was odd, but I had just reinstalled InDesign CS4 on my wife’s macbook a couple of days before. So it definitely raised an eyebrow. But then I also noticed that the message we BCC’ed to an unrelated person with my same first name…

  3. I just received one with the address as Adobe Software <adobe@adobe.com. The attachment name was Adobe_License_Key_Order#1834-453

    The email read:

    Hello.

    Thank you for buying {Adobe InDesign CS4|Acrobat X Pro|Acrobat® X Standard|Acrobat® X Suite|After Effects CS6|Adobe Audition CS6|Adobe Captivate 6|ColdFusion|ColdFusion Builder 2|Adobe Connect|Contribute CS5 software|Creative Suite® 6 Design Standard|Creative Suite 6 Design & Web Premium|Creative Suite 6 Master Collection|Digital Publishing Suite, Professional Edition Digital Publishing Suite|Director 11.5|Dreamweaver CS6} software.
    Your Adobe License key is in attached document below.

    Adobe Systems Incorporated.

    • I received the same exact email yesterday 6/28/12 @ 12:07pm with the same exact order number. My email said no virus found, so i attemped to open it and nothing happened so I did not make a second attempt. However my email came from key@adobe.com. Guess its definitley a scam!

  4. Mine came from Adobe [software@adobe.com]

    I’d like to know how Adron can see who a message was Blind Carbon Copied to.

  5. Just got one from order_complete@adobe.com

    Email read:

    Hello.

    Thank you for buying {Adobe InDesign CS4|Acrobat X Pro|Acrobat® X Standard|Acrobat® X Suite|After Effects CS6|Adobe Audition CS6|Adobe Captivate 6|ColdFusion|ColdFusion Builder 2|Adobe Connect|Contribute CS5 software|Creative Suite® 6 Design Standard|Creative Suite 6 Design & Web Premium|Creative Suite 6 Master Collection|Digital Publishing Suite, Professional Edition Digital Publishing Suite|Director 11.5|Dreamweaver CS6} software.
    Your Adobe License key is in attached document below.

    Adobe Systems Incorporated.

Comments are closed.