Fake Air Canada emails with order confirmation contains URL that downloads malicious ZIP file


MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject in the format “Your Order#74267102 – PROCESSED”.

The email is send from the spoofed address “Air Canada <tickets@aircanada.com>” and has the following body:

Dear Customer,

Your order has been successfully processed.

FLIGHT NUMBER TB7392CA
ELECTRONIC 74267102
DATE & TIME / DECEMBER 6, 2012, 10:30 AM
DEPARTING / Toronto
TOTAL PRICE / 375.12 CAD

Please download and print your ticket from the following URL : http://www.aircanada.com/aco/manageMyBookings.do?tid=TB7392CA&ticket_number=74267102

For more information regarding your order, contact us by visiting , visit : http://www.aircanada.com/en/customercare/index.html?orderid=74267102&ssid=1524

Thank you
Air Canada.

The embedded URL does not points the browser to the real web site address but to hxxp://air-canada.org/tickets/ticketTB7392CA.zip. Once this file is extracted you will have the 175 kB large file ticketTB7392CA.scr.

The trojan is known as Trojan-Spy.Win32.Zbot.gtvm, Trojan.Zbot or Trojan.Agent/Gen-Festo.

At the time of writing, 4 of the 46 AV engines did detect the trojan at Virus Total.

Virus Total permalink and SHA256: 1eb3236e4461f1f4bf5293987186461921d114e820725c7a7b0d5c9fcd9faba4.

18 thoughts on “Fake Air Canada emails with order confirmation contains URL that downloads malicious ZIP file

  1. Thanks!
    my email said this:

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER ET62082CA
    ELECTRONIC 63916372
    DATE & TIME / FEB 19, 2013, 10:22 AM
    ARRIVING / TORONTO
    TOTAL PRICE / CAD 419.33

    Please download and print your ticket from the following URL : hxxps://aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=63916372&acton=download&fid=ET62082CA

    For more information regarding your order, contact us by visiting : hxxp://www.aircanada.com/en/customercare/index.html

    Thank you
    America Airlines.

  2. Thanks, I also got this one.

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER CA638528ZP
    ELECTRONIC 746281562
    DATE & TIME / March 30th, 2013, 10:30 AM
    ARRIVING / Montreal
    TOTAL PRICE / 320.33 CAD

    Please download and print your ticket from the following URL : https://www.aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=746281562&acton=download&fid=CA638528ZP

    For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html

    Thank you for choosing Air Canada

  3. Thanks, I just got the same as Nancy noted above. Microsoft Spam fortunatly caught it as it was sent to my work email.

  4. I just got this one…..

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER QB749920CA
    ELECTRONIC 749920
    DATE & TIME / May 25th, 2013, 14:30
    ARRIVING / Québec
    TOTAL PRICE / 350.00 CAD

    Please download and print your ticket from the following URL : https://www.aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=749920&acton=download&fid=QB749920CA

    For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html

    Thank you for choosing Air Canada

  5. just got one this morning

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER QB749920CA
    ELECTRONIC 749920
    DATE & TIME / May 25th, 2013, 14:30
    ARRIVING / Qubec
    TOTAL PRICE / 350.00 CAD

    Please download and print your ticket from the following URL : https://www.aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=749920&acton=download&fid=QB749920CA

    For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html

    Thank you for choosing Air Canada

  6. Me too ed – just now:

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER QB749920CA
    ELECTRONIC 749920
    DATE & TIME / May 25th, 2013, 14:30
    ARRIVING / Québec
    TOTAL PRICE / 350.00 CAD

    Please download and print your ticket from the following URL : https://www.aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=749920&acton=download&fid=QB749920CA

    For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html

    Thank you for choosing Air Canada

  7. Just got the same email:

    Dear Customer,

    Your credit card has been successfully processed.

    FLIGHT NUMBER QB749920CA
    ELECTRONIC 749920
    DATE & TIME / May 25th, 2013, 14:30
    ARRIVING / Québec
    TOTAL PRICE / 350.00 CAD

    Please download and print your ticket from the following URL : https://www.aircanada.com/travelInformation/viewOrderInfo.do?ticket_number=749920&acton=download&fid=QB749920CA

    For more information regarding your order, contact us by visiting : http://www.aircanada.com/en/customercare/index.html

    Thank you for choosing Air Canada

  8. Hi Guys, I experienced the same on my MAC. Question is what we do about this. Any good ideas? My sons tell me not to lose my cool but that is not helping much. Paul

  9. And here I was looking forward to my flight to Quebec, having lunch at Aux Anciens Canadiens, a quick trip to The Plains of Abraham, perhaps visit a patisserie or two. Oh well, back to work…

Comments are closed.