Argentinian AFIP Virus (AFIP is Impositive Bureau)

Viruses and worms
1

Good morning, and sorry for my english redaction.

On Tuesday morning July 19, several users have received in their e-mails, a message appeared to be issued by the AFIP (Federal Tax Administration - the Argentine tax bureau).

The mail brings a link to a Chilean site, with a PDF document called ManualSII.pdf that contains instructions for tax process. When the user clicks on the link above, downloads an executable file called Manual.exe and not the PDF file.

When running this exe file, the computer does not show anything and seemingly everything is normal.
So far Avast does not detect this virus.

I have sent to the laboratory for analysis through the Virus Chest minutes ago.

I have received the email message from (host115-113.rk000.bcn.ackstorm.net [62.97.115.113])

The URL with the virus is active. I can send to a moderator the original message and the link with the executable file.

Regards!

2

upload the file(s) to www.virustotal.com and test with 43 malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti http://virusscan.jotti.org/en
VirSCAN http://virscan.org/

3

http://www.virustotal.com/file-scan/report.html?id=9c61d767b88ed3b792c912264139be23052b4b10911b83ef542c35f6ac911016-1311087739

The scan at Virustotal have been previously made at: 2011-07-19 01:42:26 (UTC)

Suspect file from a link in a fake mail phishing/malspam.
Malicious link point to an abused site: hXXp://transportesmoya.cl/pdf/Manuales/ManualSII.pdf and redirecto to download Manual.exe

4

edit the malware link you posted so it is not clickable… http as hxxp and www as wxw

5

avast! Detect :wink:

VirusTotal - manual.exe - 10/43
http://www.virustotal.com/file-scan/report.html?id=9c61d767b88ed3b792c912264139be23052b4b10911b83ef542c35f6ac911016-1311168781